Splunk Dev

How to change color of particular column?

SCSC
Explorer

I made the column chart like this images.

I want to change the color of particular column specified by field "No." , that is as "token" by other graph.

My ideal is third image.

 

I'm sorry if my English is wrong.

SCSC_0-1656400939030.png

SCSC_2-1656401032704.png

SCSC_3-1656401567278.png

 

 

0 Karma
1 Solution

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




View solution in original post

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




SCSC
Explorer

I understand.

Thanks for reply 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...