Dashboards & Visualizations

How to add a color to the different timings field in the dashboard.

Anud
Path Finder

Hi Team,

Please let me know how to add a color to time format as below.
Below one is not matching with the requirement.
<colorPalette type="expression">if(strptime(value,"%H:%M:%S")>"25200", "#A2CC3E", "#F58F39")</colorPalette>

Timeexpecting this color in Time field
25-05-2024 19:06Red
25-05-2024 22:10Red
25-05-2024 22:16Red
26-05-2024 06:50Green
26-05-2024 06:52Green
26-05-2024 11:50Green
26-05-2024 11:52Green
27-05-2024 07:09Red
27-05-2024 07:10Red
27-05-2024 11:52Green
27-05-2024 11:57Green


Thanks in Advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If your Time field is actually an _time field then it will be in epoch format (number of seconds since 1970), if that is the case, then you could try formatting (rather than parsing) - something like this for later than 12:30 pm

<colorPalette type="expression">if(tonumber(strftime(value,"%H%M%S"))>123000, "#A2CC3E", "#F58F39")</colorPalette>

 

0 Karma

Anud
Path Finder

Yes, i agree with you.
But i was looking for time frame colors After 7 AM, 12 PM, 7 PM, 9:35 PM - Red and Before 7 AM, 12 PM, 7 PM, 9:35 PM - Green

Timeexpecting this color in Time field 
25-05-2024 19:06RedAfter 7PM
25-05-2024 22:10RedAfter 10 PM
25-05-2024 22:16RedAfter 10 PM
26-05-2024 06:50GreenBefore 7AM
26-05-2024 06:52GreenBefore 7AM
26-05-2024 11:50GreenBefore 12 PM
26-05-2024 11:52GreenBefore 12 PM
27-05-2024 07:09RedAfter 7AM
27-05-2024 07:10RedAfter 7AM
27-05-2024 11:52GreenBefore 12 PM
27-05-2024 11:57GreenBefore 12 PM
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what your question is now or is this solved?

What colour is 10am? It is after 7am but it is also before 12pm!

0 Karma

Anud
Path Finder

I have a cycle so data will come  in between 6-7 AM, 11-12 PM, 6-7 PM, 9-9:35 PM.
So i want to display the color for the time After 7 AM, 12 PM, 7 PM, 9:35 PM - Red and Before 7 AM, 12 PM, 7 PM, 9:35 PM - Green.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would it be better to say anything outside the time ranges  6-7 AM, 11-12 PM, 6-7 PM, 9-9:35 PM is red and anything inside the ranges is green?

0 Karma

Anud
Path Finder

Exactly!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<colorPalette type="expression">if(tonumber(strftime(value,"%H")) == 6 OR tonumber(strftime(value,"%H")) == 11 OR tonumber(strftime(value,"%H")) == 18 OR  (tonumber(strftime(value,"%H")) == 21 AND tonumber(strftime(value,"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>
0 Karma

Anud
Path Finder

Its working giving proper results only red color is coming on every time

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like it might not work with _time fields - try assign a new field to the formatted value e.g. 

| eval Time=strftime(_time,"%F %T")

Then change to formatting to take this new field into account

<colorPalette type="expression">if(tonumber(strftime(strptime(value,"%F %T"),"%H")) == 6 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 11 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 18 OR  (tonumber(strftime(strptime(value,"%F %T"),"%H")) == 21 AND tonumber(strftime(strptime(value,"%F %T"),"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>

Anud
Path Finder

Awesome, Its working!
Thank you very much!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...