Dashboards & Visualizations

How to display certain colors in a graph based on certain values?

Communicator

Hey guys,

So I currently have a graph which utilizes how much disk space a certain path is taking up on a certain server. Since there are several servers with different disk utilizations, the graph is all over the place with all different kinds of colors. So, what I want to do is color code the graphs based on their values of disk utilization. To be more specific, I want the servers with less than 50% of utilization to be green, the servers with 50-70% utilization to be yellow, and the servers with over 70% utilization to be shown as red.

Can someone help out?

Thanks in advance for your tips and help!

Tags (3)
0 Karma

Esteemed Legend

What is your current search command?

0 Karma

Communicator
index="tablet_os" sourcetype="df" host=dc1* sda3 OR Data
| multikv fields FileSystem, UsePct | strcat host '@' Filesystem Host_FileSystem
| eval Host_FileSystem = case(
   Host_FileSystem = "dc1prmtbap01/dev/mapper/localraid-Data", "dc1prmtbap01 /data",
   Host_FileSystem = "dc1prmtbap01 /dev/sda3", "dc1prmtbap01/root",
   Host_FileSystem = "dc1prmtbap02/dev/mapper/localraid-Data", "dc1prmtbap02 /data",
   Host_FileSystem = "dc1prmtbap02 /dev/sda3", "dc1prmtbap02/root",
   Host_FileSystem = "dc1prmtbap03/dev/mapper/localraid-Data", "dc1prmtbap03 /data",
   Host_FileSystem = "dc1prmtbap03 /dev/sda3", "dc1prmtbap03/root",
   Host_FileSystem = "dc1prmtbap04/dev/mapper/localraid-data", "dc1prmtbap04 /data",
   Host_FileSystem = "dc1prmtbap04 /dev/sda3", "dc1prmtbap04/root",
   Host_FileSystem = "dc1prmtbap05/dev/mapper/localraid-data", "dc1prmtbap05 /data",
   Host_FileSystem = "dc1prmtbap05 /dev/sda3", "dc1prmtbap05/root" ,
   1=1,  Host_FileSystem)
| timechart span=60m avg(UsePct) by Host_FileSystem
| rename avg(UsePct) as %Used
0 Karma

Builder

Hi,

I think this will be helpfull for you

http://docs.splunk.com/Documentation/Splunk/6.1/Viz/BuildandeditdashboardswithSimplifiedXML#Specify_...

Specify custom colors for fields in charts

{"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x009900, "NULL":0xC4C4C0}

Regards

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!