Dashboards & Visualizations

Help on bar chart color

Contributor

hi

I need to use a different color the 5 series of my bar chart

| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "Number" by cpu_range 

I have tested many things with rangemap, charting.fieldColors or charting.seriesColors but nothing works!
is anybody can explain me what I have to do??
Thanks

0 Karma
1 Solution

Legend

@jip31 refer to one of my older answers to invert the series using transpose command: https://answers.splunk.com/answers/548161/how-to-change-colour-of-graphs.html

Following is the query as per your use case. Once you have 5 columns as per CPU ranges defined, you can use charting.fieldColors Simple XML Chart configuration option to have the ranges colored as per your needs.

| makeresults count=30 
| fields - _time 
| eval host="host", counter=1 
| accum counter 
| eval counter=printf("%02d",counter),host=host.counter 
| fields - counter 
| eval process_cpu_used_percent=random(), process_cpu_used_percent=substr(process_cpu_used_percent,1,2) 
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100") 
| chart dc(host) as "Number" by cpu_range 
| append 
    [| makeresults 
    | fields - _time 
    | eval cpu_range="0-20,20-40,40-60,60-80,80-100" 
    | makemv cpu_range delim="," 
    | mvexpand cpu_range 
    | eval Number=0] 
| dedup cpu_range 
| sort cpu_range 
| transpose header_field=cpu_range 
| search column!="_*" 
| rename column as cpu_range

Following is the code for Simple XML Chart configuration which applies Green, Blue, Yellow, Orange and Red colors as per the ranges from 0-20, 20-40, 40-60, 60-80 and 80-100 respectively.

    <option name="charting.fieldColors">{"0-20":0x49B849,"20-40":0x006EAA,"40-60":0xE0AC16,"60-80":0xDA742E,"80-100":0xC84535}</option>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Legend

@jip31 refer to one of my older answers to invert the series using transpose command: https://answers.splunk.com/answers/548161/how-to-change-colour-of-graphs.html

Following is the query as per your use case. Once you have 5 columns as per CPU ranges defined, you can use charting.fieldColors Simple XML Chart configuration option to have the ranges colored as per your needs.

| makeresults count=30 
| fields - _time 
| eval host="host", counter=1 
| accum counter 
| eval counter=printf("%02d",counter),host=host.counter 
| fields - counter 
| eval process_cpu_used_percent=random(), process_cpu_used_percent=substr(process_cpu_used_percent,1,2) 
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100") 
| chart dc(host) as "Number" by cpu_range 
| append 
    [| makeresults 
    | fields - _time 
    | eval cpu_range="0-20,20-40,40-60,60-80,80-100" 
    | makemv cpu_range delim="," 
    | mvexpand cpu_range 
    | eval Number=0] 
| dedup cpu_range 
| sort cpu_range 
| transpose header_field=cpu_range 
| search column!="_*" 
| rename column as cpu_range

Following is the code for Simple XML Chart configuration which applies Green, Blue, Yellow, Orange and Red colors as per the ranges from 0-20, 20-40, 40-60, 60-80 and 80-100 respectively.

    <option name="charting.fieldColors">{"0-20":0x49B849,"20-40":0x006EAA,"40-60":0xE0AC16,"60-80":0xDA742E,"80-100":0xC84535}</option>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Contributor

perfect thanks

0 Karma

SplunkTrust
SplunkTrust
| makeresults count=2 
| streamstats count 
| eval _time = if (count==2,relative_time(_time,"-1h@m"), relative_time(_time,"@m")) 
| makecontinuous span=1m _time 
| eval host="host".random() 
| eval process_cpu_used_percent=random() % 100 
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100") 
| chart dc(host) as "range" by cpu_range 
| transpose 0 header_field=cpu_range 
| eval column="cpu_range"

try bar chart.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!