I am trying to create a timechart of errors with but is not working
index=xxx AND source = xxxx AND (Error* OR Exception*) | timechart distinct_count(txnid) as errCount | eval RAG = case ( errCount > 200, “Red”, errCount > 100 AND errCount <=200, “Amber” , 1==1, “ Green”)
<option name=“charting.fieldcolors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>
@ARaman77 just add the following two SPL pipes to your existing search. Current you have only one series with numerical data. So only one series color gets applied.
| eval {RAG}=errCount
| fields - RAG errCount
Can you let me know how to use it
You can assign different colours to different series in the chart. In your case, you only have one series errCount so you could set the colour of that rather than letting splunk pick a colour for you.
I want the colour of errCount to change depending on whether is greater 200, 100 or Less than 100
Try
<option name=“charting.fieldColors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>
Sorry its not working
You haven't included RAG in your chart