How to colour individual bar on a bar chart?

[willsy]

Hello, 

I have a search that returns the status "UP" / "DOWN" for various groups. 
At the moment both UP and down are the same colour. 

how do i return the;
status=up green
status=down red

Edit ** Code
index=test host=ABC source=table.csv sourcetype=csv Group=Snow*
| eval Group=if(Group="Snow Day Here we come 12345","Snow",Group)
| eval Status=if(Status="Down (Acknowledged)", "Down", Status)
| dedup _raw
| stats count by Status

This gives me
Status                     Count
Down                      12
Up                            45

I would like those in a bar chart one column as red one as green

[ITWhisperer]

You can't have different colours for bars in the same series, only different colours for different series.

[yeahnah]

Hi @willsy 

It's often useful if you show your SPL code too as that sets the output which defines how the output will look in the chart.

Anyway, here's a run anywhere example of a bar chart with different colours for UP or DOWN

| makeresults | eval count="1 2", count=split(count, " ") | mvexpand count
| eval count=count%2
      ,status=if(count=1, "UP", "DOWN")
      ,count=1
 ``` SPL above creates dummy event ``` 
| chart max(count) OVER count BY status

Hope it helps to get you going

[willsy]

I have put the search above, hopefully that helps.

[yeahnah]

Try this...

index=test host=ABC source=table.csv sourcetype=csv Group=Snow*
| eval Group=if(Group="Snow Day Here we come 12345","Snow",Group)
| eval Status=if(Status="Down (Acknowledged)", "Down", Status)
| dedup _raw
| chart max(Count) OVER Count BY Status
| filldown
| tail 1
| eval Status=""
| table Status Down Up