Splunk Search

Change column color if over a range

Path Finder

Hi all, i need to change the color of a bar of the column chart if the value is higher than a number.
How can i do this?
My search query is:

eventtype="searchDC" Type="Audit Success" CategoryString="Logon/Logoff" | stats count by user 

Thanks to all who can help me

Tags (2)

Motivator

I'm not sure this is doable directly, but you can cheat by splitting your data into two series:

eventtype="searchDC" Type="Audit Success" CategoryString="Logon/Logoff"
| stats count by user
| eval high=if(count>1000,count,0)
| eval low=count-high
| fields user,high,low

Replace 1000 with whatever you want your threshold number to be.

When you create your bar chart, set Stack Mode to 'stacked' and Multi-series mode to 'Combined' so that the empty bars don't leave gaps. The legend will also show two series ("high" and "low"), but you can always just turn the legend display off.

If you are using it in a dashboard and want a specific color, such as turning all of the "high" values red, take a look at this page: http://www.splunk.com/base/Documentation/4.1.5/Developer/AdvancedCharting

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!