How to change the stacked bar chart color based on percentage?

[sundarhcl_2022]

Hi,

 I have Percentage calculated for Compliance and Non Compliance based on the data .Now i need to segregate it based on colors in staked bar chart.

Now ,the for all Non Comp % between 90 to 95 should be shown in yellow and rest should be in red .The  Non compliance is 95 to 100.

Please let me know the search for this .My search

| savedsearch_Saved_Search
| eval total_count=Compliant+NonCompliant
| eval "Compliance %"=round(100*'Compliant'/total_count,2)
| eval "Non Compliance %"=round(100*'NonCompliant'/total_count,2)

|stats count by msc "Compliance %" "Non Compliance %" 

[PickleRick]

I don't understand, to be frank, what you want to achieve.

This last stats count is a complete mystery to me.

If you just count the compliance/non compliance percentages, it's also not very clear. You want to have a row of collumns stacking up to 100%? (because compliant + non-compliant should sum up to total_count).

And as far as I know you have different colours for different data series. You can't conditionally colour the same dataseries elements. At least not with the built-in visualization.

You could however do a "trick" and separate Non-compliance into two separate series

| eval total_count=Compliant+NonCompliant
| eval CompliancePercent=round(100*'Compliant'/total_count,2)
| eval NonCompliancePercent=round(100*'NonCompliant'/total_count,2)
| eval NonCompliance9x=if(NonCompliancePercent>90 and NonCompliancePercent<95,NonCompliancePercent,null())
| eval NonComplianceRest=if(NonCompliancePercent<=90 OR NonCompliancePercent>=95,NonCompliancePercent,null())
| table msc "CompliancePercent" NonCompliance9x NonComplianceRest

[sundarhcl_2022]

Thank you Rick,

the new color just applies on NonCompliant % but there is no change in chart for values between 90 to 95 .

Please let me know whether any thing can be altered.

[PickleRick · Accepted solution]

Well, what can I say... works for me.

Unless you wanted something else completely but that's what I understood.

[sundarhcl_2022]

It worked PickleRick .

Thank you .

[sundarhcl_2022]

Rick , 

Kindly let me know whether this can be achieved ,

when % is 0 to 90 then green 

when  %  is  90 to 95  then yellow

when  % is 95 to 100  then red 

[PickleRick]

As I said before - it's not a pretty solution because you're splitting the data into separate fields to have separate data series in the results and it's getting more ugly as you're adding additional "ranges" which in reality cause you to create new fields. But yes, you can do that.

Just as you had:

| eval NonCompliance9x=if(NonCompliancePercent>90 and NonCompliancePercent<95,NonCompliancePercent,null())
| eval NonComplianceRest=if(NonCompliancePercent<=90 OR NonCompliancePercent>=95,NonCompliancePercent,null())

You might as well do more of them:

| eval range0010=if(NonCompliancePercent<10,NonCompliancePercent,null())
| eval range1020=if(NonCompliancePercent>=10 AND NonCompliancePercent<20,NonCompliancePercent,null())
[... and so on ...]
This way you'll get separate data series which you'll be able to chart with different colours (and other of those range* data series will be empty at that point so they won't be charted - that's the trick).

You probably could wrap this into a macro or maybe even automate somehow but to be honest I don't have the capacity at the moment to look into it.

If it was only this parameter, you could also probably use bin stats and xyseries

[sundarhcl_2022]

NonCompliance9x is the field not populating and hence i am not getting the  o/p expected . My code is as below ,

| savedsearch Saved_Search
| eval total_count=Compliant+NonCompliant
| eval Compliancepercent=round(100*'Compliant'/total_count,2)
| eval Noncompliancepercent=round(100*'NonCompliant'/total_count,2)
| eval NonCompliance9x=if(Noncompliancepercent>90 and Noncompliancepercent<95,Noncompliancepercent,null())
| eval NonComplianceRest=if(Noncompliancepercent<90 or Noncompliancepercent>95,Noncompliancepercent,null())
| table trmsc Compliancepercent NonCompliance9x NonComplianceRest

[VatsalJagani]

Try this on simple XML:

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-put-condition-in-xml-to-change-colo...

[sundarhcl_2022]

Thank you Jagani .

But this didnt give any change to by chart .

i tried like 

| eval yellowCount=case('Non Compliance %' < 10.00 AND 'Non Compliance %' >5.00,yellowCount."Yellow",true(),yellowCount)

|stats count by trmsc "Compliance %" "Non Compliance %" yellowCount

|fields - sort_field Compliant NonCompliant total_count count

Please suggest me a way .

[yuanliu]

What @VatsalJagani meant is for you to read the linked solution, which really comes down to <option name="charting.fieldColors" />.  You need to open Source to edit.  See General chart properties; you can also see an example in Specify custom colors for fields in charts. (Thanks to Jagani's pointer, I get to apply custom color myself!)

[VatsalJagani]

That is correct. Thanks @yuanliu