Splunk Search

Change bar chart bar color based on percentage value

Communicator
tag="*" LocID="-7" SbuID="-7" | dedup tag |eval x=substr(ResponseDisplay,1,3) |eval y=substr(AvailabilityDisplay,1,3)| stats values(x) values(y) by tag  

I have the search running below. x is a number up to 100. If x is greater than 75, I want it to be green. If it is 50 or below, I would like it to be red. Otherwise I want it to be yellow (51-74). Same thing for y. Please help! Thanks!

This is what I have for xml so far.

    <chart>
      <title>AHM Main</title>
      <searchString>tag="*" LocID="-7" SbuID="-7" | dedup tag |eval x=substr(ResponseDisplay,1,3) |eval y=substr(AvailabilityDisplay,1,3)| stats values(x) values(y) by tag</searchString>
      <earliestTime>-15m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">bottom</option>
      <option name="charting.axisY.maximumNumber">100</option>
      <option name="charting.axisTitleX.text">Application</option>
      <option name="charting.fieldColors">{"reda":0xFF0000,"yellowa":0xFFFF00, "greena":0x73A550, "redr":0xFF0000,"yellowr":0xFFFF00, "greenr":0x73A550}</option>
    </chart>
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Update to 6.2 and take a look at the new Distributed Management Console. For example, http://splunk_host:8000/en-US/app/splunk_management_console/resource_usage_instance has several bar charts coloured according to percentage.

View solution in original post

SplunkTrust
SplunkTrust

Update to 6.2 and take a look at the new Distributed Management Console. For example, http://splunk_host:8000/en-US/app/splunk_management_console/resource_usage_instance has several bar charts coloured according to percentage.

View solution in original post