Splunk Search

Bar color based on value

marellasunil
Communicator

I have a table with values & host names. I wanted to take avg of all values by host and to create a bar chart, If the average value exceeding the limit, the bar should be green else it should be red, and also on mouse-over on the bar avg value should be displayed.

Query : sourcetype=XXXXX | chart avg(value) by Server
For ex
Host Value
Server1 20
Server2 22
Server1 19
Server2 26

I wanted average values of server1, and if it crosses 80, bar for server should be red else green, same for server2 as well.

Kindly help.

0 Karma
1 Solution

marellasunil
Communicator

.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value

Then I have used "charting.fieldColors" in dashboard XML

View solution in original post

0 Karma

marellasunil
Communicator

.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value

Then I have used "charting.fieldColors" in dashboard XML

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...