I'm trying to create a column chart (bar graph) in my Splunk (v8.1.3) dashboard that shows the availabilities of a given service for various instances, whereby the bars showing percent availability change color depending on their value. For any availability greater than or equal to 0 and less than 90, I want the bar to be red. For any availability greater than or equal to 90 and less than or equal to 100, I want the bar to be green. For any availability outside of those ranges, the default color is fine. Seems simple enough and this question has been asked in several different forms several times over the years, but I just can't seem to get mine to work. The availability bars just keep showing in blue, and I've tried with both the rangemap and eval methods. See the XML of my chart based on the rangemap solution below. Any help is greatly appreciated.
<chart>
<title>rhnsd Availability - my-db-*</title>
<search>
<query>index=om host="my-db-*" sourcetype=ps rhnsd | stats count by host | addinfo | eval availability=if(count>=(info_max_time-info_min_time)/1800,100,count/floor((info_max_time-info_min_time)/1800)*100) | rangemap field=availability red=0-90 green=90-100 | fields host availability</query>
<earliest>$query_time.earliest$</earliest>
<latest>$query_time.latest$</latest>
</search>
<option name="charting.axisY.maximumNumber">100</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.fieldColors">{"red":0xdc4e41,"green":0x53a051}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
</chart>
Essentially, this is not possible with the standard charts the way you have described the problem. The columns are drawn as a series. You can colour the series as a whole, but not parts of the series. In order to get different colours for different numerical values, first you would have to split them off into different series.
Yeah I even tried adding a "| eval {range}=availability" after the rangemap and that didn't work either