How to change the color of a bar if it is the highest value in the chart?

[dbcase]

Hi,

I'm trying to figure out a way to change the color of one of the bars in a series to RED if that bar happens to be the highest value vs all the rest of the bars.

I see where you can change the color if the value is in between x and y and that is helpful to learn how the color change can happen, I'm just having trouble figuring out how to get to the highest value.

[somesoni2]

Give this a try (and use the stacked in the chart's general properly)

index=top10 source=/home/oracle/workdir/account_log.csv OR source=/home/oracle/workdir/reboots_requests_summary.csv |where OBJECT_TYPE="reboot" AND DIFF=""|eval TICKET_CODE_TEXT=case(TICKET_CODE==15395,"15395-Offline Frozen",TICKET_CODE==15396,"15396-Offline Black Screen",TICKET_CODE==15397,"15397-Offline Stuck Booting",TICKET_CODE==15398,"15398-Offline Operational",TICKET_CODE==15399,"15399-Online Frozen",TICKET_CODE==15400,"15400-Online Black Screen",TICKET_CODE==15401,"15401-Online Stuck Booting")|stats dc(PREMISE) as "PREMISE COUNT" by TICKET_CODE_TEXT|sort -"PREMISE COUNT" | eventstats max("PREMISE COUNT") as "PREMISE COUNT (MAX)" | eval "PREMISE COUNT(MAX)"=if('PREMISE COUNT'='PREMISE COUNT (MAX)','PREMISE COUNT (MAX)',0) | eval "PREMISE COUNT"=if('PREMISE COUNT'='PREMISE COUNT (MAX)',0,'PREMISE COUNT')

[dbcase]

Interesting idea. Gets closer but it seems to add the first column to all the data points instead of it being just the first one

[dbcase]

Sure!!!

index=top10 source=/home/oracle/workdir/account_log.csv OR source=/home/oracle/workdir/reboots_requests_summary.csv |where OBJECT_TYPE="reboot" AND DIFF=""|eval TICKET_CODE_TEXT=case(TICKET_CODE==15395,"15395-Offline Frozen",TICKET_CODE==15396,"15396-Offline Black Screen",TICKET_CODE==15397,"15397-Offline Stuck Booting",TICKET_CODE==15398,"15398-Offline Operational",TICKET_CODE==15399,"15399-Online Frozen",TICKET_CODE==15400,"15400-Online Black Screen",TICKET_CODE==15401,"15401-Online Stuck Booting")|stats dc(PREMISE) as "PREMISE COUNT" by TICKET_CODE_TEXT|sort -"PREMISE COUNT"

[dbcase]

Ok little bit of an update. I figured out that I can sort the results so that the first bar will always be the highest value. Which is closer to what I'm looking for. How can I change the color of the 1st bar but only the first bar?

[somesoni2]

Can you post your current search?