Dashboards & Visualizations

How to add a color to the different timings field in the dashboard.

Anud
Path Finder

Hi Team,

Please let me know how to add a color to time format as below.
Below one is not matching with the requirement.
<colorPalette type="expression">if(strptime(value,"%H:%M:%S")>"25200", "#A2CC3E", "#F58F39")</colorPalette>

Timeexpecting this color in Time field
25-05-2024 19:06Red
25-05-2024 22:10Red
25-05-2024 22:16Red
26-05-2024 06:50Green
26-05-2024 06:52Green
26-05-2024 11:50Green
26-05-2024 11:52Green
27-05-2024 07:09Red
27-05-2024 07:10Red
27-05-2024 11:52Green
27-05-2024 11:57Green


Thanks in Advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If your Time field is actually an _time field then it will be in epoch format (number of seconds since 1970), if that is the case, then you could try formatting (rather than parsing) - something like this for later than 12:30 pm

<colorPalette type="expression">if(tonumber(strftime(value,"%H%M%S"))>123000, "#A2CC3E", "#F58F39")</colorPalette>

 

0 Karma

Anud
Path Finder

Yes, i agree with you.
But i was looking for time frame colors After 7 AM, 12 PM, 7 PM, 9:35 PM - Red and Before 7 AM, 12 PM, 7 PM, 9:35 PM - Green

Timeexpecting this color in Time field 
25-05-2024 19:06RedAfter 7PM
25-05-2024 22:10RedAfter 10 PM
25-05-2024 22:16RedAfter 10 PM
26-05-2024 06:50GreenBefore 7AM
26-05-2024 06:52GreenBefore 7AM
26-05-2024 11:50GreenBefore 12 PM
26-05-2024 11:52GreenBefore 12 PM
27-05-2024 07:09RedAfter 7AM
27-05-2024 07:10RedAfter 7AM
27-05-2024 11:52GreenBefore 12 PM
27-05-2024 11:57GreenBefore 12 PM
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what your question is now or is this solved?

What colour is 10am? It is after 7am but it is also before 12pm!

0 Karma

Anud
Path Finder

I have a cycle so data will come  in between 6-7 AM, 11-12 PM, 6-7 PM, 9-9:35 PM.
So i want to display the color for the time After 7 AM, 12 PM, 7 PM, 9:35 PM - Red and Before 7 AM, 12 PM, 7 PM, 9:35 PM - Green.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would it be better to say anything outside the time ranges  6-7 AM, 11-12 PM, 6-7 PM, 9-9:35 PM is red and anything inside the ranges is green?

0 Karma

Anud
Path Finder

Exactly!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<colorPalette type="expression">if(tonumber(strftime(value,"%H")) == 6 OR tonumber(strftime(value,"%H")) == 11 OR tonumber(strftime(value,"%H")) == 18 OR  (tonumber(strftime(value,"%H")) == 21 AND tonumber(strftime(value,"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>
0 Karma

Anud
Path Finder

Its working giving proper results only red color is coming on every time

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like it might not work with _time fields - try assign a new field to the formatted value e.g. 

| eval Time=strftime(_time,"%F %T")

Then change to formatting to take this new field into account

<colorPalette type="expression">if(tonumber(strftime(strptime(value,"%F %T"),"%H")) == 6 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 11 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 18 OR  (tonumber(strftime(strptime(value,"%F %T"),"%H")) == 21 AND tonumber(strftime(strptime(value,"%F %T"),"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>

Anud
Path Finder

Awesome, Its working!
Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...