<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Color range over time by field in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/503970#M33331</link>
    <description>&lt;P&gt;Why&amp;nbsp; don't you try&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;format type="color"&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;without &lt;EM&gt;field&lt;/EM&gt;&amp;nbsp;&amp;nbsp;designation&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;sample:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;table background color&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| tstats avg(PREFIX("average_kbps=")) as average_kbps where index=_internal source="*metrics.log" by _time span=1d
| eval header="average_kbps" , time=strftime(_time,"%F")
| eventstats max(average_kbps) as maximum
| eval perc=round(average_kbps / maximum * 100)
| xyseries header time perc&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;0&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;format type="color"&amp;gt;
          &amp;lt;colorPalette type="list"&amp;gt;[#FF0000,#FFFF00,#53A051]&amp;lt;/colorPalette&amp;gt;
          &amp;lt;scale type="threshold"&amp;gt;50,90&amp;lt;/scale&amp;gt;
        &amp;lt;/format&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;&lt;/LI-CODE&gt;</description>
    <pubDate>Thu, 11 Jun 2020 17:32:30 GMT</pubDate>
    <dc:creator>to4kawa</dc:creator>
    <dc:date>2020-06-11T17:32:30Z</dc:date>
    <item>
      <title>Color range over time by field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/503881#M33328</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;/P&gt;&lt;P&gt;I had a search to get the range of colors which shows the availablity significance over time&lt;/P&gt;&lt;P&gt;My search is like below&lt;/P&gt;&lt;P&gt;Index=xyz | bucket span=1h l&amp;nbsp; eval ftime =strftime(_time, "%d-%m-%Y %H:%M") | chart values (percent) as requests over country by ftime&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;My columns varies dynamically as per the time range and span of my bucket&lt;/P&gt;&lt;P&gt;Where I need to set color as&amp;nbsp;&lt;/P&gt;&lt;P&gt;Percentage 0 to&amp;nbsp; &amp;nbsp;50 = red( back ground color)&lt;/P&gt;&lt;P&gt;Percentage 50-90= yellow( back ground color)&lt;/P&gt;&lt;P&gt;Percentage 90-100= green(back ground color)&lt;/P&gt;&lt;P&gt;My results comes as&lt;/P&gt;&lt;P&gt;Bg: background color&lt;/P&gt;&lt;P&gt;=============================&lt;/P&gt;&lt;P&gt;Country&amp;nbsp; 1-05-20 01:00.&amp;nbsp;1-05-20 01:00&amp;nbsp;&lt;/P&gt;&lt;P&gt;US.&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;99.(r&lt;SPAN&gt;ed bg)&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 80(yellow bg)&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;==================================&lt;/P&gt;&lt;P&gt;For the case if column is constant then it is working fine&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;lt;format type='color' field= "name"&amp;gt;&lt;/P&gt;&lt;P&gt;But here the column field is dynamic, can some help me how to achieve&amp;nbsp; this in XML&amp;nbsp; please&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 11 Jun 2020 10:03:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/503881#M33328</guid>
      <dc:creator>Suresh</dc:creator>
      <dc:date>2020-06-11T10:03:38Z</dc:date>
    </item>
    <item>
      <title>Re: Color range over time by field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/503970#M33331</link>
      <description>&lt;P&gt;Why&amp;nbsp; don't you try&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;format type="color"&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;without &lt;EM&gt;field&lt;/EM&gt;&amp;nbsp;&amp;nbsp;designation&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;sample:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;dashboard&amp;gt;
  &amp;lt;label&amp;gt;table background color&amp;lt;/label&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| tstats avg(PREFIX("average_kbps=")) as average_kbps where index=_internal source="*metrics.log" by _time span=1d
| eval header="average_kbps" , time=strftime(_time,"%F")
| eventstats max(average_kbps) as maximum
| eval perc=round(average_kbps / maximum * 100)
| xyseries header time perc&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;0&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;format type="color"&amp;gt;
          &amp;lt;colorPalette type="list"&amp;gt;[#FF0000,#FFFF00,#53A051]&amp;lt;/colorPalette&amp;gt;
          &amp;lt;scale type="threshold"&amp;gt;50,90&amp;lt;/scale&amp;gt;
        &amp;lt;/format&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/dashboard&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 11 Jun 2020 17:32:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/503970#M33331</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-06-11T17:32:30Z</dc:date>
    </item>
    <item>
      <title>Re: Color range over time by field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/504184#M33340</link>
      <description>&lt;P&gt;Thanks it worked &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 12 Jun 2020 15:27:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Color-range-over-time-by-field/m-p/504184#M33340</guid>
      <dc:creator>Suresh</dc:creator>
      <dc:date>2020-06-12T15:27:59Z</dc:date>
    </item>
  </channel>
</rss>

