Colour in timechart

[ARaman77]

I am trying to create a timechart of errors with but is not working 

index=xxx  AND source = xxxx AND (Error* OR Exception*) | timechart distinct_count(txnid) as errCount | eval RAG = case ( errCount > 200, “Red”,  errCount > 100 AND errCount <=200, “Amber” , 1==1,  “ Green”)

<option name=“charting.fieldcolors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>

[niketn]

@ARaman77 just add the following two SPL pipes to your existing search. Current you have only one series with numerical data. So only one series color gets applied.

| eval {RAG}=errCount
| fields - RAG errCount

[ARaman77]

Can you let me know how to use it

[ITWhisperer]

You can assign different colours to different series in the chart. In your case, you only have one series errCount so you could set the colour of that rather than letting splunk pick a colour for you.

[ARaman77]

I want the colour of errCount to change depending on whether is greater 200, 100 or Less than 100

[ITWhisperer]

Try 

<option name=“charting.fieldColors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>

[ARaman77]

Sorry its not working

[ITWhisperer]

You haven't included RAG in your chart