Dashboards & Visualizations

Colour in timechart

ARaman77
Explorer

I am trying to create a timechart of errors with but is not working 

index=xxx  AND source = xxxx AND (Error* OR Exception*) | timechart distinct_count(txnid) as errCount | eval RAG = case ( errCount > 200, “Red”,  errCount > 100 AND errCount <=200, “Amber” , 1==1,  “ Green”)

<option name=“charting.fieldcolors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>

Labels (1)
Tags (1)
0 Karma

niketn
Legend

@ARaman77 just add the following two SPL pipes to your existing search. Current you have only one series with numerical data. So only one series color gets applied.

| eval {RAG}=errCount
| fields - RAG errCount

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ARaman77
Explorer

Can you let me know how to use it

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can assign different colours to different series in the chart. In your case, you only have one series errCount so you could set the colour of that rather than letting splunk pick a colour for you.

0 Karma

ARaman77
Explorer

I want the colour of errCount to change depending on whether is greater 200, 100 or Less than 100

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try 

<option name=“charting.fieldColors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>
0 Karma

ARaman77
Explorer

Sorry its not working

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You haven't included RAG in your chart

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...