Splunk Dev

How to change color of particular column?

SCSC
Explorer

I made the column chart like this images.

I want to change the color of particular column specified by field "No." , that is as "token" by other graph.

My ideal is third image.

 

I'm sorry if my English is wrong.

SCSC_0-1656400939030.png

SCSC_2-1656401032704.png

SCSC_3-1656401567278.png

 

 

0 Karma
1 Solution

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




View solution in original post

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




SCSC
Explorer

I understand.

Thanks for reply 🙂

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...