Splunk Dev

Splunk Bar Chart Colors

harishfysx
Engager

 

 

Hi I am fairly new to Splunk , thank you in advance if you can help me...:)

My goal is to log the service response duration each time a ESService is called. The ESService value can be anything. In the table format below I am able to see which service is being hit and the duration .

 

But in the visualization section, all the events showing the same color, Is there anyway to show different color for each ESService . For example , when ESBusinessrep blue, for ESPerson red etc.(dynamically there can be N number of service types). And when I hover on the bars they are showing time, and duration values only not the ESService. How to achieve this?

harishfysx_0-1710879098247.png

 

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

A bar chart will give you a different colour for each series, so you would need to do something like

| chart max(duration) over _time by ESService

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

A bar chart will give you a different colour for each series, so you would need to do something like

| chart max(duration) over _time by ESService

 

0 Karma

harishfysx
Engager

Thank you bowesmana!.

Really appreciate your help on this.  

now I am greedy....

Can  I get query to get Max, Average, Minimum of each ESService?

 
0 Karma

harishfysx
Engager
transaction transactionId startswith="step=Before" endswith="step=After" | stats max(duration) as MaxRespTime avg(duration) as AvgRespTime min(duration) as MinRespTime by ESService

This should do it . 

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...