topic Colour in timechart in Dashboards & Visualizations

Colour in timechart

ARaman77 — Fri, 09 Oct 2020 12:52:35 GMT

I am trying to create a timechart of errors with but is not working

index=xxx AND source = xxxx AND (Error* OR Exception*) | timechart distinct_count(txnid) as errCount | eval RAG = case ( errCount > 200, “Red”, errCount > 100 AND errCount <=200, “Amber” , 1==1, “ Green”)

<option name=“charting.fieldcolors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>

Re: Colour in timechart

ITWhisperer — Fri, 09 Oct 2020 12:55:33 GMT

Try

<option name=“charting.fieldColors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>

Re: Colour in timechart

ARaman77 — Fri, 09 Oct 2020 13:07:19 GMT

Sorry its not working

Re: Colour in timechart

ITWhisperer — Fri, 09 Oct 2020 13:28:03 GMT

You haven't included RAG in your chart

Re: Colour in timechart

ARaman77 — Sat, 10 Oct 2020 06:43:43 GMT

Can you let me know how to use it

Re: Colour in timechart

ITWhisperer — Sat, 10 Oct 2020 09:00:20 GMT

You can assign different colours to different series in the chart. In your case, you only have one series errCount so you could set the colour of that rather than letting splunk pick a colour for you.

Re: Colour in timechart

ARaman77 — Sat, 10 Oct 2020 15:52:16 GMT

I want the colour of errCount to change depending on whether is greater 200, 100 or Less than 100

Re: Colour in timechart

niketn — Sun, 11 Oct 2020 10:22:03 GMT

@ARaman77 just add the following two SPL pipes to your existing search. Current you have only one series with numerical data. So only one series color gets applied.

| eval {RAG}=errCount | fields - RAG errCount