Splunk Search

How do I change bar color based on y axis value in timechart?

Digister
Explorer

Hi there,

I have already found several answers to the question about how to apply color ranges on the column chart, but I didn't manage to get them to work using a timechart.

My search looks like this:
index="index" startupTime=* | timechart span=1hour count(startupTime) by host limit=0
I have like 100 hosts and I want to mark hosts green which are only having one restart an hour, 2-4 restarts yellow and 4-max red.

Is this somehow possible using a time chart?

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...