Splunk Search

Horizontal Bar Chart Bar Colors: How to create search?

jason_hotchkiss
Communicator

I have a horizontal bar chart usingthe following post processing search:

| stats count by urgency
| eval urgency = if(urgency=="-", "unknown", 'urgency')

The values of the urgency field are:

"1 - High"
"2 - Medium"
"3 - Low"
"unknown"

I would like the horizontal bar color to change for each value:

"1 - High"  would be Red
"2 - Medium" would be Orange
"3 - Low" would be Yellow
"unknown" would remain blue

I have seen code for working with value ranges, but I am looking for code that works only with the value.  

Any suggestions are grealy appreciated


Labels (1)
Tags (2)
0 Karma
1 Solution

jamie00171
Communicator

Hi @jason_hotchkiss,

I've done similar before, adding the below should work:

<option name="charting.fieldColors">{"1 - High": <insert CSS color code for desired red here>,  "2 - Medium": <insert CSS color code for desired orange here>,  "3 - Low":  <insert CSS color code for desired yellow here>, "unknown":  <insert CSS color code for desired blue here>}</option>

Thanks, 

Jamie

View solution in original post

jamie00171
Communicator

Hi @jason_hotchkiss,

I've done similar before, adding the below should work:

<option name="charting.fieldColors">{"1 - High": <insert CSS color code for desired red here>,  "2 - Medium": <insert CSS color code for desired orange here>,  "3 - Low":  <insert CSS color code for desired yellow here>, "unknown":  <insert CSS color code for desired blue here>}</option>

Thanks, 

Jamie

jason_hotchkiss
Communicator

@jamie00171 

So this snippet only works with the values in the key, which in my case is only count.

1 - High       ########################
2 - Med       ###########
3 - Low        ############                                               count
unknown    ######

If I use count in the charting.fieldcolors it works.
Not if I use the actual field values.


Still looking for how to work with the values.

0 Karma

jason_hotchkiss
Communicator

I changed my prost processing search to:

| eval urgency = if(urgency=="-", "unknown", 'urgency')
| stats
count(eval(urgency="1 - High")) as "1 - High"
count(eval(urgency="2 - Medium")) as "2 - Medium"
count(eval(urgency=="3 - Low")) as "3 - Low"
count(eval(urgency="unknown")) as "unknown"
by urgency

This puts the values in the key, and then the charting.fieldcolors works.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...