Bar Chart Splunk6

[xisura]

Hi!

Is there a way in splunk 6 to change the color of the bar graph based on the search result like in rangemap??

Thanks in Advanced!
Jarize

[martin_mueller · Accepted solution]

You can do something like this:

some search | timechart avg(some_value) as avg | eval green = case(avg < 50, avg) | eval yellow = case(avg < 80, avg) | eval red = case(avg >= 80, avg) | fields - avg

Display the resulting chart as a stacked column chart, and set the colors to green, yellow and red.