Splunk Dev

How to change color of particular column?

SCSC
Explorer

I made the column chart like this images.

I want to change the color of particular column specified by field "No." , that is as "token" by other graph.

My ideal is third image.

 

I'm sorry if my English is wrong.

SCSC_0-1656400939030.png

SCSC_2-1656401032704.png

SCSC_3-1656401567278.png

 

 

Labels (1)
0 Karma
1 Solution

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




View solution in original post

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




SCSC
Explorer

I understand.

Thanks for reply 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...