Splunk Search

How to change colors of bars in bargraph chart based on their numerical value?

bsg273
Path Finder

I'm trying to create a column chart (bar graph) in my Splunk (v8.1.3) dashboard that shows the availabilities of a given service for various instances, whereby the bars showing percent availability change color depending on their value.  For any availability greater than or equal to 0 and less than 90, I want the bar to be red.  For any availability greater than or equal to 90 and less than or equal to 100, I want the bar to be green.  For any availability outside of those ranges, the default color is fine.  Seems simple enough and this question has been asked in several different forms several times over the years, but I just can't seem to get mine to work.  The availability bars just keep showing in blue, and I've tried with both the rangemap and eval methods.  See the XML of my chart based on the rangemap solution below.  Any help is greatly appreciated.

 

      <chart>
        <title>rhnsd Availability - my-db-*</title>
        <search>
          <query>index=om host="my-db-*" sourcetype=ps rhnsd  | stats count by host | addinfo | eval availability=if(count&gt;=(info_max_time-info_min_time)/1800,100,count/floor((info_max_time-info_min_time)/1800)*100) | rangemap field=availability red=0-90 green=90-100 | fields host availability</query>
          <earliest>$query_time.earliest$</earliest>
          <latest>$query_time.latest$</latest>
        </search>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.axisY.minimumNumber">0</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.fieldColors">{"red":0xdc4e41,"green":0x53a051}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>

 

 

Labels (3)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Essentially, this is not possible with the standard charts the way you have described the problem. The columns are drawn as a series. You can colour the series as a whole, but not parts of the series. In order to get different colours for different numerical values, first you would have to split them off into different series.

0 Karma

bsg273
Path Finder

Yeah I even tried adding a "| eval {range}=availability" after the rangemap and that didn't work either

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...