topic Re: Bar color based on value on chart in Splunk Search

Bar color based on value on chart

karakutu — Thu, 20 Jul 2017 14:50:26 GMT

Hi everbody

i want to create color bar chart which color change based value.
i see different example for stats but there is no example for chart

can i create chart with value based color?

index=main sourcetype="Perfmon:Free
Disk Space" counter="% Free Space"
|chart avg(Value) by host | eval
redCount = if(Value>80,Value,0)
| eval yellowCount = if(Value > 70 AND Value>15,Value,0)
| eval greenCount = if(Value>=15, Value, 0) | fields -
Value

Re: Bar color based on value on chart

JDukeSplunk — Thu, 20 Jul 2017 17:01:42 GMT

So.. This will be incomplete but maybe some combination of this search using rangemap and stats.

index=main sourcetype="Perfmon:Free Disk Space" counter="% Free Space" 
|stats avg(Value) as Freespace by host 
|rangemap field=Freespace Green=80-100, Yellow=11-79, Red=0-10
|stats count(eval(range="Red")) as Red count(eval(range="Yellow")) as Yellow count(eval(range="Green")) as Green

And the dashboard options shown here.

http://docs.splunk.com/Documentation/Splunk/6.1/Viz/BuildandeditdashboardswithSimplifiedXML#Specify_custom_colors_for_fields_in_charts

<option name="charting.fieldColors">
  {"Red": 0xFF0000, "Yellow": 0xFF9900, "Green":0x009900, "NULL":0xC4C4C0}
</option>

Re: Bar color based on value on chart

karakutu — Fri, 21 Jul 2017 07:00:29 GMT

why we need to use stats twice?

this search query give only one bar. however i have more than one hosts.

i want to show the diskspace status. if the disk 80% prozent full than i want to change the color of bar.

Re: Bar color based on value on chart

JDukeSplunk — Fri, 21 Jul 2017 13:42:19 GMT

I thought you wanted a summary count for all your hosts.

Anyway, try this, and combine with this article for colors. http://docs.splunk.com/Documentation/Splunk/6.1/Viz/BuildandeditdashboardswithSimplifiedXML#Specify_custom_colors_for_fields_in_charts
Remove the "instance" if you want all disks.

index=main sourcetype="Perfmon:Free Disk Space" counter="% Free Space" instance=C:
| chart avg(Value) as PercentFree by host |sort - PercentFree

Re: Bar color based on value on chart

karakutu — Fri, 21 Jul 2017 14:48:41 GMT

i did it

 <chart>
    <searchString>index=main sourcetype="Perfmon:Free Disk Space" counter="% Free Space"  | chart avg(Value) as FreeSpacePercent by host |sort - FreeSpacePercent 
    | eval redCritical = if(FreeSpacePercent >= 85,FreeSpacePercent ,0) 
    | eval yellowWarning = if(FreeSpacePercent > 55 AND FreeSpacePercent <=84,FreeSpacePercent ,0) 
    | eval greenOK = if(FreeSpacePercent < 54,FreeSpacePercent ,0) 
    | table Datastore,redCritical,yellowWarning,greenOK</searchString>
     <option name="charting.legend.labels">[redCritical,yellowWarning,greenOK]</option>
     <option name="charting.seriesColors">[0xFF0000,0xFFFF00,0x00FF00]</option>
       <option name="charting.primaryAxisTitle.text">FreeSpacePercent</option>
       <option name="charting.chart.stacked">FreeSpacePercent</option>
       <option name="charting.chart">column</option>
</chart>

Re: Bar color based on value on chart

JDukeSplunk — Fri, 21 Jul 2017 15:43:47 GMT

Nice!

I tinkered with it a little to combine host and drive letter. I also reversed green/red so that lower percent free space will show up as critical. I also rounded off the decimal and instead of using an average, I am using "last" value. Since "last" is a more accurate representation of the servers current disk usage.

sourcetype="Perfmon:Free Disk Space" counter="% Free Space" NOT instance=_total
|eval host=host." ".instance
| chart eval(round(last(Value)/1,0)) as FreeSpacePercent by host
|sort - FreeSpacePercent
| eval greenOK = if(FreeSpacePercent >= 85,FreeSpacePercent ,0)
| eval yellowWarning = if(FreeSpacePercent > 55 AND FreeSpacePercent <=84,FreeSpacePercent ,0)
| eval redCritical = if(FreeSpacePercent < 54,FreeSpacePercent ,0)
| table host,redCritical,yellowWarning,greenOK