Hello Splunkers,
I have the following query
index=abc
| search host IN (*)
| search NOT host IN ( No_exclusions)
| eval lower =((ref*l)+ref)
| eval upper = if( u = "null", "10000000", (ref+(ref*u)))
| stats latest(perf_number) as perf_number by host Test upper lower
If the perf_number is within the range of upper and lower value then it should be green and if its above or below the range it should be RED.
I tried using the below in xml but it only gives me one color
<format type="color" field="perf_number">
<colorPalette type="expression"> if((perf_number >= lower) AND (perf_number <= upper), "#00FF00", "#FF0000")</colorPalette>
Thanks in Advance
I did a workaround and it worked for me
| foreach perf_number
[ eval <<FIELD>> = if(<<FIELD>> < lower OR <<FIELD>> >upper , "**".<<FIELD>>."**", <<FIELD>>)]
| chart latest(perf_number) as perf_number by Test host limit=0And in the xml I added the below
<format type="color">
<colorPalette type="expression">if (like(value,"**%")"#CD5C5C","#31373e")</colorPalette>
Hi @power12,
at first, don't use the search command after the main search: your searches are slower!
I'm not sure that's possible to setup the cell colour in dinamic mode, maybe someone else knows this solution, anyway it's surely possible in static mode.
Is it acceptable for you to add a Status field (OK,NOK) and give the colour to it?
if yes, you could use a search like this:
index=abc host IN (*) NOT (host IN (No_exclusions))
| eval
lower=((ref*l)+ref),
upper=if(u="null","10000000",(ref+(ref*u)))
| stats
latest(perf_number) AS perf_number
values(lower) AS lower
values(upper) As upper
BY host Test
| eval Status=if(perf_number>lower AND perf_number<upper,"OK,"NOK")
| table host Test Status perf_number lower upperthen you can setup the Status colour based on the value.
Ciao.
Giuseppe
Can we have the Status color match the perf_number ?...
I did a workaround and it worked for me
| foreach perf_number
[ eval <<FIELD>> = if(<<FIELD>> < lower OR <<FIELD>> >upper , "**".<<FIELD>>."**", <<FIELD>>)]
| chart latest(perf_number) as perf_number by Test host limit=0And in the xml I added the below
<format type="color">
<colorPalette type="expression">if (like(value,"**%")"#CD5C5C","#31373e")</colorPalette>
Hi @power12,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated ![]()
Hi @power12,
good for you, see next time!
let me know if I can help you more, or, please, accept one answer for the other people of Community.
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated ![]()