topic Re: How i can show the color for different values for multi panels in Dashboards & Visualizations

How i can show the color for different values for multi panels

Anud — Mon, 10 Mar 2025 13:28:58 GMT

Here is the query using output will come count and that value shows using single value.
file runs 4 times daily. I will create 4 panels show the NUM =1, 2, 3, 4 count.
how i can show the field timestatus output is complete, incomplete and inprogress for each panel color.

Thanks in Advance!

Re: How i can show the color for different values for multi panels

ITWhisperer — Mon, 10 Mar 2025 14:17:47 GMT

Firstly, you need a search which delivers the value you want. This search is a bit confusing. You are formatting a time field and then within the same statement parsing the result using exactly to same format string. You may as well evaluate lrm_frmt_time to lrm_time.

timestatus is coming from your join but you are ignoring it in your final stats command so it is thrown away.

You should try to avoid joins if possible, therefore, I suggest you rewrite the search (or provide a working version), or is that what you are seeking help with, as opposed to how to set the colour on a single visualisation?

Re: How i can show the color for different values for multi panels

Anud — Mon, 10 Mar 2025 14:24:55 GMT

Thank you very much for your quick response!
yes, Need visualization based on timestatus wether it is completed,inprogress and incomplete.

index=myindex NUM
| where isnull(NXT)
| dedup MC
| join NUM
[search index=myindex3 ID
| eval ID = printf("%01d",ID)
| rename ID as NUM
| stats count by NUM
| eval timestatus=case(count >5, "Complete", count == 0, "Incomplete", count > 0 AND count >= 5, "In Progress") ]
| search NUM = 1 | stats count AS Total

Output is to show only total count. background "NUM" wise we need to display the colors based on the field "timestatus"