Bar Chart Column Color Based on Value

[caviman2201]

I have a very simple bar chart that I'm trying to configure so that the bar colors turn red if the value for "FreeSpacePercent" is under 10, yellow if its between 10 and 20 and green if above 20. The chart displays the free space on various datastores in our vCenter environment. Here's my search:

sourcetype="csv" Datastore=* | table Datastore,FreeSpacePercent | sort FreeSpacePercent

I've looked at several different posts on this, but they all appear to rely on stats and counts. Thanks in advance.

[somesoni2 · Accepted solution]

Have a look at the solution of similar question.

http://answers.splunk.com/answers/7228/change-column-color-if-over-a-range

Update

If you're using simple xml, you can use something like this (you'll be charting the new fields in stacked mode)

 <dashboard>
 <label>FreeSpacePercent</label>
 <row>
  <chart>
   <searchString>sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent &lt;= 15,FreeSpacePercent ,0) | eval yellowWarning = if(FreeSpacePercent &gt; 15 AND FreeSpacePercent &lt;=20,FreeSpacePercent ,0) | eval greenOK = if(FreeSpacePercent &gt; 20,FreeSpacePercent ,0) | table Datastore,redCritical,yellowWarning,greenOK</searchString>
    <option name="charting.legend.labels">[redCritical,yellowWarning,greenOK]</option>
    <option name="charting.seriesColors">[0xFF0000,0xFFFF00,0x00FF00]</option>
      <option name="charting.primaryAxisTitle.text">FreeSpacePercent</option>
      <option name="charting.chart.stacked">FreeSpacePercent</option>
      <option name="charting.chart">column</option>
   </chart>
  </row>
</dashboard>

[caviman2201]

Thanks so much.

[somesoni2]

Add the sort command "| sort FreeSpacePercent " before the eval statements.

[caviman2201]

Ah ha! That worked! for some reason the >, <, = symbols worked but the &gt, etc ones in the XML above did not. Do you know how to get it to sort by FreeSpacePercent so that the lowest is on top? piping that to Sort FreeSpacePercent didn't do anything.

[somesoni2]

Can you check if this query returns correct data? For each row there should be 4 fields: Datastore,redCritical, yellowWarning,greenOK and 2 out redCritical, yellowWarning,greenOK have value 0 and other 1 non-zero.

sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent <= 15,FreeSpacePercent ,0) | eval yellowWarning = if(FreeSpacePercent > 15 AND FreeSpacePercent <=20,FreeSpacePercent ,0) | eval greenOK = if(FreeSpacePercent > 20,FreeSpacePercent ,0) | table Datastore,redCritical,yellowWarning,greenOK

[caviman2201]

This just generates a blank chart with a legend containing redCritical, yellowWarning and greenOK.

[somesoni2]

Updated the query. In eval, you need to assign value of FreeSpacePercent if the criteria is met.

[caviman2201]

Here's the search with the working evals:

sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent <= 15,Datastore,0) | eval yellowWarning = if(FreeSpacePercent > 15 AND FreeSpacePercent <=20,Datastore,0) | eval greenOK = if(FreeSpacePercent >20,Datastore,0) | table Datastore,FreeSpacePercent | Sort FreeSpacePercent

I just don't know what to do from here and that white paper really doesn't help...

[caviman2201]

I did see that post and was able to generate the "evals" I need to make this work. I just don't know how to actually get the chart to display those evaluated values. It's more the charting part than the eval part that I need help with and that post just says "read this white paper".