I'm very new to Splunk and I really need your help, because I couldn't find a proper solution searching through the topics.
I determine the TotalCount of events containing Field1="Wirecheck" with all Results="Pass", "Reject", "Warn". The percentage of the events with the result "Pass" is determined, as well.
index="IndexTest" Field1="Wirecheck" | stats count as "TotalCountWirecheckField2" by Field2 | appendcols [search index="IndexTest" Field1="Wirecheck" Result="Pass" | stats count as "ResultCountPassWirecheckField2" by field2] | eval percent=(ResultCountPassWirecheckField2/TotalCountWirecheckField2)*100 | eval RoundIntegerWirecheckField2 = round(percent, 1)
I would like to visualize the "Pass"-events using column charts. Next to the height of the columns, which is represented by the TotalCountPass, I'd like to show a range represented by the color of the column. Therefore I have seperated new fields depending on the pass-percentage: