Bar color based on value

[marellasunil]

I have a table with values & host names. I wanted to take avg of all values by host and to create a bar chart, If the average value exceeding the limit, the bar should be green else it should be red, and also on mouse-over on the bar avg value should be displayed.

Query : sourcetype=XXXXX | chart avg(value) by Server
For ex
Host Value
Server1 20
Server2 22
Server1 19
Server2 26

I wanted average values of server1, and if it crosses 80, bar for server should be red else green, same for server2 as well.

Kindly help.

[marellasunil · Accepted solution]

.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value

Then I have used "charting.fieldColors" in dashboard XML

[jeffland]

See http://answers.splunk.com/answers/58335/change-chart-bar-color-based-on-data-value.html