Monitoring Splunk

how to change graph color to Red, Green and Yellow based on some condition

yagnaprasad
New Member

index=osnixscript sourcetype=cpu host=* | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart span=5m avg(Percent_CPU_Load) by host

i  have modified above query into below and added conditions based on criteria to change the color of the graph..


index=osnixscript sourcetype=cpu host=* | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart span=5m avg(Percent_CPU_Load) by host | eval Threshold_Color=case(Percent_CPU_Load>0 AND Percent_CPU_Load>2, "Normal", Percent_CPU_Load>2 AND Percent_CPU_Load <=8, "Warning", Percent_CPU_Load > 8 AND Percent_CPU_Load < 90, "Critical")

i have added code in the xml with <option name="charting.fieldColors">{"Normal":0xFF0000,"Warning":0xFFFF00, "Critical":0x73A550}</option>

I couldn't be able to see the change in graph colors based on the conditions defined in the query. Can someone please look into the query and correct me with changes required to fix this issue. Thanks in Advance

 

 

 

 

Labels (1)
0 Karma

yagnaprasad
New Member

I am looking for graph color change if we put condition for ex: if(cpuusage <40) then the graph color should be in "Green". if (cpuusage >40 and cpuusage <75) then graph color should be in "Yellow". if cpuusage > 75 then the graph color should be in Red. Please suggest us with the changes needs to be done w.r.to query and source code (xml changes required). Please help us. Thanks in Advance.

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...