Help on bar chart color

[jip31]

hi

I need to use a different color the 5 series of my bar chart

| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "Number" by cpu_range 

I have tested many things with rangemap, charting.fieldColors or charting.seriesColors but nothing works!
is anybody can explain me what I have to do??
Thanks

[niketn · Accepted solution]

@jip31 refer to one of my older answers to invert the series using transpose command: https://answers.splunk.com/answers/548161/how-to-change-colour-of-graphs.html

Following is the query as per your use case. Once you have 5 columns as per CPU ranges defined, you can use charting.fieldColors Simple XML Chart configuration option to have the ranges colored as per your needs.

| makeresults count=30 
| fields - _time 
| eval host="host", counter=1 
| accum counter 
| eval counter=printf("%02d",counter),host=host.counter 
| fields - counter 
| eval process_cpu_used_percent=random(), process_cpu_used_percent=substr(process_cpu_used_percent,1,2) 
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100") 
| chart dc(host) as "Number" by cpu_range 
| append 
    [| makeresults 
    | fields - _time 
    | eval cpu_range="0-20,20-40,40-60,60-80,80-100" 
    | makemv cpu_range delim="," 
    | mvexpand cpu_range 
    | eval Number=0] 
| dedup cpu_range 
| sort cpu_range 
| transpose header_field=cpu_range 
| search column!="_*" 
| rename column as cpu_range

Following is the code for Simple XML Chart configuration which applies Green, Blue, Yellow, Orange and Red colors as per the ranges from 0-20, 20-40, 40-60, 60-80 and 80-100 respectively.

    <option name="charting.fieldColors">{"0-20":0x49B849,"20-40":0x006EAA,"40-60":0xE0AC16,"60-80":0xDA742E,"80-100":0xC84535}</option>

Please try out and confirm!

[jip31]

perfect thanks

[to4kawa]

| makeresults count=2 
| streamstats count 
| eval _time = if (count==2,relative_time(_time,"-1h@m"), relative_time(_time,"@m")) 
| makecontinuous span=1m _time 
| eval host="host".random() 
| eval process_cpu_used_percent=random() % 100 
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
    process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
    process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
    process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
    process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100") 
| chart dc(host) as "range" by cpu_range 
| transpose 0 header_field=cpu_range 
| eval column="cpu_range"

try bar chart.