Splunk Search
Highlighted

Custom value based column color when using chart with split-by field

Path Finder

I have a field representing runs, runId (run1, run2, run3, ...) of a batch of tests, field testName (test1, test2, test3, ...). For every test during each run I have field testDuration in seconds (10, 20, 30, ...). I used this query to visualize tests' durations during each run:

| chart max(testDuration) over runId by testName

That query works fine, but now I need a little change, the chart should stay the same with this small modification: all testDurations that are longer than 20s should be red and all testDurations that are shorter than 20s should be green. Anybody knows how to do it? Thanks.

Here is a simple mockup of the chart I am looking for (test names inside columns are just for demonstration purposes)
alt text

Tags (2)
Highlighted

Re: Custom value based column color when using chart with split-by field

SplunkTrust
SplunkTrust

You're looking for charting.seriesColors and simple xml dashboards. You cant just do it in a regular search, i has to be part of a dashbaord:

<dashboard>
 <label>My dashboard</label>
 <row>
  <panel>
    <chart>
     <searchName>My saved report</searchName>
      <option name="charting.legend.labels">[error,warn,info]</option>
      <option name="charting.seriesColors">[0xFF0000,0xFFFF00,0x00FF00]</option>
     </chart>
  </panel>
  </row>
</dashboard>

http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/Chartcustomization

Also see my explanations/answers here:
https://answers.splunk.com/answers/66734/bar-chart-color.html

Highlighted

Re: Custom value based column color when using chart with split-by field

Path Finder

Yes Simple XML dashboard is OK for me. But I do not see how to set green and red colors using charting options when my query is a chart split by testName. If I understand the chart command correctly it produces table where the first column is runId, second column is test durations for test1, third test durations for test2, and so on for all tests. Then chart tag takes this table and uses the first column as X-axis values and second and all further columns as Y-axis values stacked onto each other.

Highlighted

Re: Custom value based column color when using chart with split-by field

SplunkTrust
SplunkTrust

Can you confirm this is what the data looks like?

runId=1,testName=1,testDuration=4s
runId=1,testName=2,testDuration=5s
runId=1,testName=3,testDuration=41s
runId=2,testName=1,testDuration=34s
runId=2,testName=2,testDuration=45s
runId=2,testName=3,testDuration=41s
runId=3,testName=1,testDuration=14s
runId=3,testName=2,testDuration=25s
runId=3,testName=3,testDuration=31s
0 Karma
Highlighted

Re: Custom value based column color when using chart with split-by field

Path Finder

I need to wait before I can update the question, I do not have enough reputation 😞

Highlighted

Re: Custom value based column color when using chart with split-by field

SplunkTrust
SplunkTrust

Just post it in the comments. I upvoted to give you more rep too.

0 Karma
Highlighted

Re: Custom value based column color when using chart with split-by field

Path Finder

yeah, with just one change that is not important, testName is not number but some name:
runId=1,testName=test1, testDuration=4s
runId=1,testName=test2, testDuration=5s
runId=1,testName=test3, testDuration=41s
runId=2,testName=test1, testDuration=34s
runId=2,testName=test2, testDuration=45s
runId=2,testName=test3, testDuration=41s
runId=3,testName=test1, testDuration=14s
runId=3,testName=test2, testDuration=25s
runId=3,testName=test3, testDuration=31s

And potentially more tests.

Mockup of the desired chart(test names inside columns are just for demonstration purposes):
alt text

I will update the question with mockup chart later, because I do not have enough karma.

0 Karma
Highlighted

Re: Custom value based column color when using chart with split-by field

SplunkTrust
SplunkTrust

Will there always be 3 runs??? maybe 10 runs max?

I've got a solution if so

0 Karma
Highlighted

Re: Custom value based column color when using chart with split-by field

Path Finder

All tests are executed every hour, so there will be infinite number of runs. But if that is not possible I could try to use constant number of runs.

0 Karma
Highlighted

Re: Custom value based column color when using chart with split-by field

SplunkTrust
SplunkTrust

I guess i meant to ask can runId be 1-3 each time... or 1 - 10 each time?

0 Karma