Dashboards & Visualizations

How to add a color to the different timings field in the dashboard.

Anud
Path Finder

Hi Team,

Please let me know how to add a color to time format as below.
Below one is not matching with the requirement.
<colorPalette type="expression">if(strptime(value,"%H:%M:%S")>"25200", "#A2CC3E", "#F58F39")</colorPalette>

Timeexpecting this color in Time field
25-05-2024 19:06Red
25-05-2024 22:10Red
25-05-2024 22:16Red
26-05-2024 06:50Green
26-05-2024 06:52Green
26-05-2024 11:50Green
26-05-2024 11:52Green
27-05-2024 07:09Red
27-05-2024 07:10Red
27-05-2024 11:52Green
27-05-2024 11:57Green


Thanks in Advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If your Time field is actually an _time field then it will be in epoch format (number of seconds since 1970), if that is the case, then you could try formatting (rather than parsing) - something like this for later than 12:30 pm

<colorPalette type="expression">if(tonumber(strftime(value,"%H%M%S"))>123000, "#A2CC3E", "#F58F39")</colorPalette>

 

0 Karma

Anud
Path Finder

Yes, i agree with you.
But i was looking for time frame colors After 7 AM, 12 PM, 7 PM, 9:35 PM - Red and Before 7 AM, 12 PM, 7 PM, 9:35 PM - Green

Timeexpecting this color in Time field 
25-05-2024 19:06RedAfter 7PM
25-05-2024 22:10RedAfter 10 PM
25-05-2024 22:16RedAfter 10 PM
26-05-2024 06:50GreenBefore 7AM
26-05-2024 06:52GreenBefore 7AM
26-05-2024 11:50GreenBefore 12 PM
26-05-2024 11:52GreenBefore 12 PM
27-05-2024 07:09RedAfter 7AM
27-05-2024 07:10RedAfter 7AM
27-05-2024 11:52GreenBefore 12 PM
27-05-2024 11:57GreenBefore 12 PM
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what your question is now or is this solved?

What colour is 10am? It is after 7am but it is also before 12pm!

0 Karma

Anud
Path Finder

I have a cycle so data will come  in between 6-7 AM, 11-12 PM, 6-7 PM, 9-9:35 PM.
So i want to display the color for the time After 7 AM, 12 PM, 7 PM, 9:35 PM - Red and Before 7 AM, 12 PM, 7 PM, 9:35 PM - Green.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would it be better to say anything outside the time ranges  6-7 AM, 11-12 PM, 6-7 PM, 9-9:35 PM is red and anything inside the ranges is green?

0 Karma

Anud
Path Finder

Exactly!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<colorPalette type="expression">if(tonumber(strftime(value,"%H")) == 6 OR tonumber(strftime(value,"%H")) == 11 OR tonumber(strftime(value,"%H")) == 18 OR  (tonumber(strftime(value,"%H")) == 21 AND tonumber(strftime(value,"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>
0 Karma

Anud
Path Finder

Its working giving proper results only red color is coming on every time

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like it might not work with _time fields - try assign a new field to the formatted value e.g. 

| eval Time=strftime(_time,"%F %T")

Then change to formatting to take this new field into account

<colorPalette type="expression">if(tonumber(strftime(strptime(value,"%F %T"),"%H")) == 6 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 11 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 18 OR  (tonumber(strftime(strptime(value,"%F %T"),"%H")) == 21 AND tonumber(strftime(strptime(value,"%F %T"),"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>

Anud
Path Finder

Awesome, Its working!
Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...