Renaming data series
Is it possible to rename data series in a chart? I send my Auth0 logs into Sumo, and I'm charting log type frequency. The log types are labelled with shorthand codes like 'fp' for a failed password or ssa for a 'successful silent auth'. So I have something like:
_sourceCategory=auth0/logs/dev
| json auto
| where client_name = "Auth0 Client 1" or client_name = "Auth0 Client 2"
| where type matches "s" or type matches "ssa" or type matches "fp" or type matches "fu"
| timeslice by 1d
| sum
| count by _timeslice, type
| sort by type
| transpose row _timeslice column type
And I want to rename the data series in the charts from, e.g., 'fp' to 'failed password'.
-
Hey Mark,
You can use a simple If() statement like this:
_sourceCategory=auth0/logs/dev
| json auto
| where client_name = "Auth0 Client 1" or client_name = "Auth0 Client 2"
| where type matches "s" or type matches "ssa" or type matches "fp" or type matches "fu"
| if (type="fp", "failed password", type) as type
| if (type="ssa", "successful silent auth", type) as type
| timeslice by 1d
| sum
| count by _timeslice, type
| sort by type
| transpose row _timeslice column type
Or you can do a nested If() like this:
_sourceCategory=auth0/logs/dev
| json auto
| where client_name = "Auth0 Client 1" or client_name = "Auth0 Client 2"
| where type matches "s" or type matches "ssa" or type matches "fp" or type matches "fu"
| if (type="fp", "failed password",if (type="ssa", "successful silent auth", type)) as type
| timeslice by 1d
| sum
| count by _timeslice, type
| sort by type
| transpose row _timeslice column type
Please sign in to leave a comment.
Comments
2 comments