https://community.splunk.com/t5/Splunk-Search/pie-chart-color-with-eval-condition/m-p/226285#M66711 <P>You will need to save it as a dashboard panel first of all. Once there, you can edit the charting options to define the colors.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/Chartcustomization#Chart_colors">http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/Chartcustomization#Chart_colors</A></P> <P>You may also want to use rangemap to break down the days into the sizes you want. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rangemap">http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rangemap</A></P> <P>Ive only ever done rangemap inline, so something similar to this. You're going probably going to have to tweak this to make it work. </P> <PRE><CODE>index=level3 host=Test |rangemap AgeRange=count(Age) Under_3=0-3 4to7=4-7 Over=8-9999| chart count by AgeRange </CODE></PRE> Fri, 30 Sep 2016 13:54:18 GMT JDukeSplunk 2016-09-30T13:54:18Z https://community.splunk.com/t5/Splunk-Search/pie-chart-color-with-eval-condition/m-p/226284#M66710 <P>Am using query "index=level3 host=Test | stats count by Age | sort Age" and visualizing it in a pie chart. </P> <P>Now my requirement is I want to put some condition and color code it accordingly and show the result as in figure: Age<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1951i7CF48708054C37BA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>what query should I use and what xml editing should I do . </P> <P>Currently using the query am getting result as shown in Fig: res<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1952i50E25EBD1E4469E5/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 30 Sep 2016 13:26:20 GMT https://community.splunk.com/t5/Splunk-Search/pie-chart-color-with-eval-condition/m-p/226284#M66710 surekhasplunk 2016-09-30T13:26:20Z https://community.splunk.com/t5/Splunk-Search/pie-chart-color-with-eval-condition/m-p/226285#M66711 <P>You will need to save it as a dashboard panel first of all. Once there, you can edit the charting options to define the colors.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/Chartcustomization#Chart_colors">http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/Chartcustomization#Chart_colors</A></P> <P>You may also want to use rangemap to break down the days into the sizes you want. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rangemap">http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rangemap</A></P> <P>Ive only ever done rangemap inline, so something similar to this. You're going probably going to have to tweak this to make it work. </P> <PRE><CODE>index=level3 host=Test |rangemap AgeRange=count(Age) Under_3=0-3 4to7=4-7 Over=8-9999| chart count by AgeRange </CODE></PRE> Fri, 30 Sep 2016 13:54:18 GMT https://community.splunk.com/t5/Splunk-Search/pie-chart-color-with-eval-condition/m-p/226285#M66711 JDukeSplunk 2016-09-30T13:54:18Z