topic Re: How do I change the font color in a chart depending on a value? in Splunk Search

How do I change the font color in a chart depending on a value?

jmauritz — Wed, 12 Dec 2018 13:25:25 GMT

Hello,

I try to change the font colour within a chart. Unfortunately I can only create dashboards and don't have any admin rights. Here is my search:

index=int  Up
| rex field=_raw "Up (?.*) \((?.*)\);(?.*);(?.*);(?.*)"
| chart values(status) BY host name useother=false

I would like to have the font color green if the values(status) is "healthy" and red if the values(status) is "unhealthy". Unfortunately, I can't change the color directly at the field, because the field names are also dynamic (name).

Do you have any idea how I can manage this ?

Thank you in advance for your support

Julia

Re: How do I change the font color in a chart depending on a value?

dkeck — Wed, 12 Dec 2018 14:04:31 GMT

Hi,

maybe this can get you some ideas

https://answers.splunk.com/answers/675789/how-to-change-the-font-color-in-a-dashboard-depend.html

Re: How do I change the font color in a chart depending on a value?

niketn — Wed, 12 Dec 2018 14:18:16 GMT

@jmauritz is this for Table visualization or Chart? What does your current visualization look like and what is the expected output? If you can add a screenshot/mock up for both that would be great for the community members to assist.

If you are looking for color based on values like health or unhealthy you can use Table visualization and Color based on cell value which is available in version 6.5 and higher. The same can be done either directly via UI > Edit > Format Visualization > Edit Table Column > Table Cell Color by Value or else using table Simple XML configuration.

On separate notes, while posting the code use the code button i.e. 101010 or shortcut Ctrl+G, to ensure that special characters do not escape. As per your current code what if a host has both values health and unhealthy for the same host.

Re: How do I change the font color in a chart depending on a value?

jmauritz — Wed, 12 Dec 2018 14:50:39 GMT

Here is a printscreen from the statistic. Maybe this helps. I think because the field name is a variable I can't change the color of the field depending on his value. Am I right ?