How to display certain colors in a graph based on certain values?

[splunkman341]

Hey guys,

So I currently have a graph which utilizes how much disk space a certain path is taking up on a certain server. Since there are several servers with different disk utilizations, the graph is all over the place with all different kinds of colors. So, what I want to do is color code the graphs based on their values of disk utilization. To be more specific, I want the servers with less than 50% of utilization to be green, the servers with 50-70% utilization to be yellow, and the servers with over 70% utilization to be shown as red.

Can someone help out?

Thanks in advance for your tips and help!

[woodcock]

What is your current search command?

[splunkman341]

index="tablet_os" sourcetype="df" host=dc1* sda3 OR Data
| multikv fields FileSystem, UsePct | strcat host '@' Filesystem Host_FileSystem
| eval Host_FileSystem = case(
   Host_FileSystem = "dc1prmtbap01/dev/mapper/localraid-Data", "dc1prmtbap01 /data",
   Host_FileSystem = "dc1prmtbap01 /dev/sda3", "dc1prmtbap01/root",
   Host_FileSystem = "dc1prmtbap02/dev/mapper/localraid-Data", "dc1prmtbap02 /data",
   Host_FileSystem = "dc1prmtbap02 /dev/sda3", "dc1prmtbap02/root",
   Host_FileSystem = "dc1prmtbap03/dev/mapper/localraid-Data", "dc1prmtbap03 /data",
   Host_FileSystem = "dc1prmtbap03 /dev/sda3", "dc1prmtbap03/root",
   Host_FileSystem = "dc1prmtbap04/dev/mapper/localraid-data", "dc1prmtbap04 /data",
   Host_FileSystem = "dc1prmtbap04 /dev/sda3", "dc1prmtbap04/root",
   Host_FileSystem = "dc1prmtbap05/dev/mapper/localraid-data", "dc1prmtbap05 /data",
   Host_FileSystem = "dc1prmtbap05 /dev/sda3", "dc1prmtbap05/root" ,
   1=1,  Host_FileSystem)
| timechart span=60m avg(UsePct) by Host_FileSystem
| rename avg(UsePct) as %Used

[jmallorquin]

Hi,

I think this will be helpfull for you

http://docs.splunk.com/Documentation/Splunk/6.1/Viz/BuildandeditdashboardswithSimplifiedXML#Specify_...

Specify custom colors for fields in charts

{"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x009900, "NULL":0xC4C4C0}

Regards