Splunk Search

How do I change the font color in a chart depending on a value?

New Member


I try to change the font colour within a chart. Unfortunately I can only create dashboards and don't have any admin rights. Here is my search:

index=int  Up
| rex field=_raw "Up (?.*) \((?.*)\);(?.*);(?.*);(?.*)"
| chart values(status) BY host name useother=false

I would like to have the font color green if the values(status) is "healthy" and red if the values(status) is "unhealthy". Unfortunately, I can't change the color directly at the field, because the field names are also dynamic (name).

Do you have any idea how I can manage this ?

Thank you in advance for your support


0 Karma

New Member

alt text

Here is a printscreen from the statistic. Maybe this helps. I think because the field name is a variable I can't change the color of the field depending on his value. Am I right ?

0 Karma


@jmauritz is this for Table visualization or Chart? What does your current visualization look like and what is the expected output? If you can add a screenshot/mock up for both that would be great for the community members to assist.

If you are looking for color based on values like health or unhealthy you can use Table visualization and Color based on cell value which is available in version 6.5 and higher. The same can be done either directly via UI > Edit > Format Visualization > Edit Table Column > Table Cell Color by Value or else using table Simple XML configuration.

On separate notes, while posting the code use the code button i.e. 101010 or shortcut Ctrl+G, to ensure that special characters do not escape. As per your current code what if a host has both values health and unhealthy for the same host.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!