Dashboards & Visualizations

Colour in timechart

ARaman77
Explorer

I am trying to create a timechart of errors with but is not working 

index=xxx  AND source = xxxx AND (Error* OR Exception*) | timechart distinct_count(txnid) as errCount | eval RAG = case ( errCount > 200, “Red”,  errCount > 100 AND errCount <=200, “Amber” , 1==1,  “ Green”)

<option name=“charting.fieldcolors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>

Labels (1)
Tags (1)
0 Karma

niketn
Legend

@ARaman77 just add the following two SPL pipes to your existing search. Current you have only one series with numerical data. So only one series color gets applied.

| eval {RAG}=errCount
| fields - RAG errCount

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ARaman77
Explorer

Can you let me know how to use it

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can assign different colours to different series in the chart. In your case, you only have one series errCount so you could set the colour of that rather than letting splunk pick a colour for you.

0 Karma

ARaman77
Explorer

I want the colour of errCount to change depending on whether is greater 200, 100 or Less than 100

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try 

<option name=“charting.fieldColors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option>
0 Karma

ARaman77
Explorer

Sorry its not working

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You haven't included RAG in your chart

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...