Splunk Search

Display the different color based on status value and Client Wise.


run the below query and got the output

index=xxx sc_status=201 OR sc_status=200

| stats count(eval(sc_status)) as "Total Hits", avg(time_taken) as Avg_Time_Taken by date, cs_host, sc_status


required different Color based on status on y-axis(Total value)

Required Out as per the below screen shot.


Labels (1)
0 Karma

Ultra Champion

Splunk column chart cannot be displayed with two values on x-axis.

This is not possible because the chart is trying to separate the time and host values.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...