Splunk Search

Display the different color based on status value and Client Wise.

sachdeva_2007
Explorer

run the below query and got the output

index=xxx sc_status=201 OR sc_status=200

| stats count(eval(sc_status)) as "Total Hits", avg(time_taken) as Avg_Time_Taken by date, cs_host, sc_status

Concern:

required different Color based on status on y-axis(Total value)

Required Out as per the below screen shot.

desired_result.png)

Labels (1)
0 Karma

to4kawa
Ultra Champion

Splunk column chart cannot be displayed with two values on x-axis.

This is not possible because the chart is trying to separate the time and host values.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...