https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-my-search-to-output-results-in-certain-colors/m-p/219110#M64408 <P>Have you considered the <CODE>rangemap</CODE> command? <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Rangemap">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Rangemap</A></P> Mon, 11 Jan 2016 15:53:32 GMT sundareshr 2016-01-11T15:53:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-my-search-to-output-results-in-certain-colors/m-p/219109#M64407 <P>Hi Everyone,</P> <P>I have this query which is running and giving me the difference of errors from yesterday and today based on Name, but need a little help in modifying it.</P> <PRE><CODE>earliest="-1500m@m" latest="-1440m@m" index=Test host=* | chart count(Errors) as "Yesterday" by Name | join type=outer Name [search index=Test host=* earliest =-60m@m latest=now | chart count(Errors) as "Today" by Name] | eval errDiff=(((Today-Yesterday)/Yesterday)*100) . "%" | sort -Yesterday </CODE></PRE> <P>It is giving the desired result.<BR /> But now I want to get the result based on the % of errors.</P> <P>For e.g <BR /> errDiff 0-24 must be GREEN<BR /> errDiff 25-49 must be YELLOW<BR /> errDiff &gt;50 must be RED</P> <PRE><CODE>earliest="-1500m@m" latest="-1440m@m" index=Test host=* | chart count(Errors) as "Yesterday" by Name | join type=outer Name [search index=Test host=* earliest =-60m@m latest=now | chart count(Errors) as "Today" by Name] | eval errDiff=(((Today-Yesterday)/Yesterday)*100) | eval errDiff=case(errDiff&gt;=0 AND errDiff&lt;25, "GREEN", errDiff&gt;=25 AND errDiff&lt;50, "YELLOW", errDiff&gt;=50, "RED") | sort -Yesterday </CODE></PRE> <P>This one is coming perfectly, but it is not showing the errDiff %. I need errDiff % as well as the classification based on color...</P> <P>Any leads?</P> <P>TIA</P> Mon, 11 Jan 2016 08:13:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-my-search-to-output-results-in-certain-colors/m-p/219109#M64407 tanhadil4vr 2016-01-11T08:13:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-my-search-to-output-results-in-certain-colors/m-p/219110#M64408 <P>Have you considered the <CODE>rangemap</CODE> command? <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Rangemap">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Rangemap</A></P> Mon, 11 Jan 2016 15:53:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-modify-my-search-to-output-results-in-certain-colors/m-p/219110#M64408 sundareshr 2016-01-11T15:53:32Z