Timechart command and changing Visualization colors

[Hegemon76]

Hello,

I think I've very close to getting this working.....but having issues with the eval command for some reason? Can't seem to figure out why and the error doesn't give me much to go on....

Basically just trying to get different colors into the horizontal barchart.

product=Windows EventCode=645 OR EventCode=4741 | timechart span=1w count | eval Severe=if(count>25,count,0) | eval High=if(count<=25 AND count>20,count,0) |eval Moderate=if(count<=20 AND count>15,count,0) | eval Low=if(count<=15, count>7,count, 0) | eval Very_Low=if(count<=7, count=>0,count, 0) |convert timeformat="%Y-%m-%d" ctime(Date)| rename _time as Date, count as Count

XML

    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.fieldColors">{"Severe":0xFF0000,"High":0xff8000,"Moderate":0xFFFF00,"Low":0x00FF00,"Very Low":0x0000ff}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>

Thanks!

[Hegemon76 · Accepted solution]

Answered my own question but a different issue appeared! I was missing two operators in the search string and adjusted the "count=>0" to "count>0"

product=Windows EventCode=645 OR EventCode=4741 | timechart span=1w count | eval Severe=if(count>25,count,0) | eval High=if(count<=25 AND count>20,count, 0)| eval Moderate = if(count<=20 AND count>15,count,0) | eval Low = if(count<=15 AND count>7,count, 0) | eval Very Low = if(count<=7 AND count>0,count, 0)| rename _time as Date, count as Count |convert timeformat="%Y-%m-%d" ctime(Date)

Since I can't post pictures this is going to be difficult....

In the graph I have the colors and information I want however there is also the "count" field for obvious reasons (it is a timechart). I suppose there is no way to get rid of that?

[niketn]

@Hegemon76, I have converted your comment to answer. Please accept the same to mark this question as answered!

[Hegemon76]

I believe I have accepted!

[Anam]

Hi @Hegemon

It is great you were able to answer your question! Please post the answer here so the rest of the community can benefit from it. Also please post your second question as a new question so you can get maximum exposure on it.

Thanks!

[Hegemon76]

I did post my answer.

I will make another question. Thanks!