topic Re: colour format in chart based on the list in Splunk Search

colour format in chart based on the list

iamniks — Mon, 25 Aug 2014 12:22:01 GMT

Hi, I have a table

DATE AMOUNT
07/22/2014 1000
07/23/2014 2000
08/01/2014 500

and so on.

I have to get a bar chart of decreasing amount and date. which is easy. Now i have to represent the latest date in that chart in a different colour. Is that possible

Re: colour format in chart based on the list

MuS — Mon, 25 Aug 2014 12:25:43 GMT

Hi iamniks,

Yes, you can do this - but you need to tweak some css and js files to achieve this. See this http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values or this app http://apps.splunk.com/app/570/.

hope this helps ...

cheers, MuS

Re: colour format in chart based on the list

iamniks — Mon, 25 Aug 2014 12:52:24 GMT

thanks for the response but we can use the above if we know what is the expected value but in my case i dont know what is the latest date in the list

Re: colour format in chart based on the list

somesoni2 — Mon, 25 Aug 2014 12:55:31 GMT

How many rows can be there in the table?

Re: colour format in chart based on the list

iamniks — Mon, 25 Aug 2014 12:57:57 GMT

many. it will keep updating the list on when a transaction happens on that date. so i need a query to find the latest date in the list at any point in time

Re: colour format in chart based on the list

somesoni2 — Mon, 25 Aug 2014 13:22:27 GMT

Give this a try.

Your search giving fields DATE, AMOUNT | eval LATEST=strptime(DATE,"%m/%d/%Y") 
| eventstats max(LATEST) as LATEST1 | eval LATESTAMT=if(LATEST=LATEST1,AMOUNT,0) | eval AMOUNT=if(LATEST=LATEST1,0,AMOUNT)| table DATE, AMOUNT, LATESTAMT

Use this to generate a stacked bar chart and for the latest record it should show in different color (with different series name 'LATESTAMT')