Display the different color based on status value ... - Splunk Community

Splunk Search

run the below query and got the output

index=xxx sc_status=201 OR sc_status=200

| stats count(eval(sc_status)) as "Total Hits", avg(time_taken) as Avg_Time_Taken by date, cs_host, sc_status

Concern:

required different Color based on status on y-axis(Total value)

Required Out as per the below screen shot.

)

Splunk column chart cannot be displayed with two values on x-axis.

This is not possible because the chart is trying to separate the time and host values.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...