I am using dashboard studio and i want to compare 2 values and if they are different, highlight it red. What is the best vizualization type for this, and how do i have it color based on the comparison of the 2 values?
Are these two values in the same event, in the same field e.g. in a multivalue field, in the same field on different events, the result of two different aggregations, values from two different time periods? Please provide more details of what you are trying to achieve.
Also, does it have to be Studio or would a Classic dashboard solution meet your needs?
It is currently built out in studio so studio is needed.
They are different event codes in the same type of event (same field). I am comparing 200 code to 201 codes, and if they match, make it green, if the count differs, then red.
Please share your current search, preferably in a codeblock </>
Also, what do you want to be made green?
Code has been sanitized of identifying info, note this is filtering just on event code 200, but original search is filtered on both 200 and 201 event codes
index=wineventlog source="WinEventLog:Application" (SourceName=ABC OR SourceName=DEF) Message="*$Projlookup$*" *$openfilter$*
[
| inputlookup csvfile.csv
| search Environment="$envlookup$" Hostname IN ( $hostname$)
| fields Hostname Message EventCode
| rename Hostname as host
]
| search (EventCode=200)
| stats count by EventCode