Splunk Search

Bar Chart Column Color Based on Value

caviman2201
Path Finder

I have a very simple bar chart that I'm trying to configure so that the bar colors turn red if the value for "FreeSpacePercent" is under 10, yellow if its between 10 and 20 and green if above 20. The chart displays the free space on various datastores in our vCenter environment. Here's my search:

sourcetype="csv" Datastore=* | table Datastore,FreeSpacePercent | sort FreeSpacePercent

I've looked at several different posts on this, but they all appear to rely on stats and counts. Thanks in advance.

Tags (4)
1 Solution

somesoni2
Revered Legend

Have a look at the solution of similar question.

http://answers.splunk.com/answers/7228/change-column-color-if-over-a-range

Update

If you're using simple xml, you can use something like this (you'll be charting the new fields in stacked mode)

 <dashboard>
 <label>FreeSpacePercent</label>
 <row>
  <chart>
   <searchString>sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent &lt;= 15,FreeSpacePercent ,0) | eval yellowWarning = if(FreeSpacePercent &gt; 15 AND FreeSpacePercent &lt;=20,FreeSpacePercent ,0) | eval greenOK = if(FreeSpacePercent &gt; 20,FreeSpacePercent ,0) | table Datastore,redCritical,yellowWarning,greenOK</searchString>
    <option name="charting.legend.labels">[redCritical,yellowWarning,greenOK]</option>
    <option name="charting.seriesColors">[0xFF0000,0xFFFF00,0x00FF00]</option>
      <option name="charting.primaryAxisTitle.text">FreeSpacePercent</option>
      <option name="charting.chart.stacked">FreeSpacePercent</option>
      <option name="charting.chart">column</option>
   </chart>
  </row>
</dashboard>

View solution in original post

somesoni2
Revered Legend

Have a look at the solution of similar question.

http://answers.splunk.com/answers/7228/change-column-color-if-over-a-range

Update

If you're using simple xml, you can use something like this (you'll be charting the new fields in stacked mode)

 <dashboard>
 <label>FreeSpacePercent</label>
 <row>
  <chart>
   <searchString>sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent &lt;= 15,FreeSpacePercent ,0) | eval yellowWarning = if(FreeSpacePercent &gt; 15 AND FreeSpacePercent &lt;=20,FreeSpacePercent ,0) | eval greenOK = if(FreeSpacePercent &gt; 20,FreeSpacePercent ,0) | table Datastore,redCritical,yellowWarning,greenOK</searchString>
    <option name="charting.legend.labels">[redCritical,yellowWarning,greenOK]</option>
    <option name="charting.seriesColors">[0xFF0000,0xFFFF00,0x00FF00]</option>
      <option name="charting.primaryAxisTitle.text">FreeSpacePercent</option>
      <option name="charting.chart.stacked">FreeSpacePercent</option>
      <option name="charting.chart">column</option>
   </chart>
  </row>
</dashboard>

caviman2201
Path Finder

Thanks so much.

0 Karma

somesoni2
Revered Legend

Add the sort command "| sort FreeSpacePercent " before the eval statements.

caviman2201
Path Finder

Ah ha! That worked! for some reason the >, <, = symbols worked but the &gt, etc ones in the XML above did not. Do you know how to get it to sort by FreeSpacePercent so that the lowest is on top? piping that to Sort FreeSpacePercent didn't do anything.

somesoni2
Revered Legend

Can you check if this query returns correct data? For each row there should be 4 fields: Datastore,redCritical, yellowWarning,greenOK and 2 out redCritical, yellowWarning,greenOK have value 0 and other 1 non-zero.

sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent <= 15,FreeSpacePercent ,0) | eval yellowWarning = if(FreeSpacePercent > 15 AND FreeSpacePercent <=20,FreeSpacePercent ,0) | eval greenOK = if(FreeSpacePercent > 20,FreeSpacePercent ,0) | table Datastore,redCritical,yellowWarning,greenOK

caviman2201
Path Finder

This just generates a blank chart with a legend containing redCritical, yellowWarning and greenOK.

0 Karma

somesoni2
Revered Legend

Updated the query. In eval, you need to assign value of FreeSpacePercent if the criteria is met.

0 Karma

caviman2201
Path Finder

Here's the search with the working evals:

sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent <= 15,Datastore,0) | eval yellowWarning = if(FreeSpacePercent > 15 AND FreeSpacePercent <=20,Datastore,0) | eval greenOK = if(FreeSpacePercent >20,Datastore,0) | table Datastore,FreeSpacePercent | Sort FreeSpacePercent

I just don't know what to do from here and that white paper really doesn't help...

0 Karma

caviman2201
Path Finder

I did see that post and was able to generate the "evals" I need to make this work. I just don't know how to actually get the chart to display those evaluated values. It's more the charting part than the eval part that I need help with and that post just says "read this white paper".

0 Karma
Get Updates on the Splunk Community!

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...

Thank You for Celebrating CX Day with Splunk!

Yesterday the entire team at Splunk &#43; Cisco joined the global celebration of CX Day - celebrating our ...