Hi all,
my search is like index=main | chart count by severity
and i am getting a chart like
count in y axis, error and info in x axis and the color of both columns are blue
i modified the search in view as
index=main | chart count by severity| eval red=if(severity=="ERROR",1,0)|eval green = if(severity=="INFO",1,0)
and charting option to
{"red":0xFF0000,"green":0x00FF00}
but i am getting a wiered chart with top border color as i specified and fill color as count color, also i am not able to drill down it.
please help
Thank you
Here is an answer that may help: Change chart bar color based on data value
Note that this technique leverages a side-effect of the stats command; it does not work with the chart command.
dashboard is in simple xml, it have a dropdown box listing sources and a chart showing the severity
Here is an answer that may help: Change chart bar color based on data value
Note that this technique leverages a side-effect of the stats command; it does not work with the chart command.
The automatic drilldown will not work, because the search has eval
commands following the stats
command:
sourcetype=mysourcetype AND searchstuffforerrors | stats count by host
| eval redCount = if(count>20,count,0)
| eval yellowCount = if(count<=20 AND count>15,count,0)
| eval greenCount = if(count<=15, count, 0)
| fields - count
You should be able to include an explicit drill-down in the XML, starting with Splunk 5.0. Look here for more info on drill-down: http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Dynamicdrilldownindashboardsandforms
is it possible to use an explicit drill down option using
if so /app/search/flashtimeline?q=source=$sources$
here sources is my dropdown box result, how to create a query supporting this drill down
please help
Thanks lguinn, it worked well, but i am not able to drill down from the chart, befor changing the color i was able to . but not now,, why?
"PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"
this is the error
please help
can you post the complete XML for the dashboard ?
i tried with this option
charting.chart.fieldColors
but no change, drilldown is also not happening
pretty sure it should be charting.chart.fieldColors not charting.fieldColors