Splunk Search

## How to change the stacked bar chart color based on percentage?

Explorer

Hi,

I have Percentage calculated for Compliance and Non Compliance based on the data .Now i need to segregate it based on colors in staked bar chart.

Now ,the for all Non Comp % between 90 to 95 should be shown in yellow and rest should be in red .The  Non compliance is 95 to 100.

Please let me know the search for this .My search

``````| savedsearch_Saved_Search
| eval total_count=Compliant+NonCompliant
| eval "Compliance %"=round(100*'Compliant'/total_count,2)
| eval "Non Compliance %"=round(100*'NonCompliant'/total_count,2)

|stats count by msc "Compliance %" "Non Compliance %" ``````
Labels (1)
• ### stats

Tags (1)
1 Solution
SplunkTrust

Well, what can I say... works for me.

Unless you wanted something else completely but that's what I understood.

SplunkTrust

I don't understand, to be frank, what you want to achieve.

This last stats count is a complete mystery to me.

If you just count the compliance/non compliance percentages, it's also not very clear. You want to have a row of collumns stacking up to 100%? (because compliant + non-compliant should sum up to total_count).

And as far as I know you have different colours for different data series. You can't conditionally colour the same dataseries elements. At least not with the built-in visualization.

You could however do a "trick" and separate Non-compliance into two separate series

`| eval total_count=Compliant+NonCompliant| eval CompliancePercent=round(100*'Compliant'/total_count,2)| eval NonCompliancePercent=round(100*'NonCompliant'/total_count,2)| eval NonCompliance9x=if(NonCompliancePercent>90 and NonCompliancePercent<95,NonCompliancePercent,null())| eval NonComplianceRest=if(NonCompliancePercent<=90 OR NonCompliancePercent>=95,NonCompliancePercent,null())| table msc "CompliancePercent" NonCompliance9x NonComplianceRest`
Explorer

Thank you Rick,

the new color just applies on NonCompliant % but there is no change in chart for values between 90 to 95 .

Please let me know whether any thing can be altered.

SplunkTrust

Well, what can I say... works for me.

Unless you wanted something else completely but that's what I understood.

Explorer

It worked PickleRick .

Thank you .

Tags (1)
Explorer

Rick ,

Kindly let me know whether this can be achieved ,

when % is 0 to 90 then green

when  %  is  90 to 95  then yellow

when  % is 95 to 100  then red

SplunkTrust

As I said before - it's not a pretty solution because you're splitting the data into separate fields to have separate data series in the results and it's getting more ugly as you're adding additional "ranges" which in reality cause you to create new fields. But yes, you can do that.

`| eval NonCompliance9x=if(NonCompliancePercent>90 and NonCompliancePercent<95,NonCompliancePercent,null())| eval NonComplianceRest=if(NonCompliancePercent<=90 OR NonCompliancePercent>=95,NonCompliancePercent,null())`

You might as well do more of them:

`| eval range0010=if(NonCompliancePercent<10,NonCompliancePercent,null())| eval range1020=if(NonCompliancePercent>=10 AND NonCompliancePercent<20,NonCompliancePercent,null())[... and so on ...]This way you'll get separate data series which you'll be able to chart with different colours (and other of those range* data series will be empty at that point so they won't be charted - that's the trick).`

You probably could wrap this into a macro or maybe even automate somehow but to be honest I don't have the capacity at the moment to look into it.

If it was only this parameter, you could also probably use bin stats and xyseries

Explorer

NonCompliance9x is the field not populating and hence i am not getting the  o/p expected . My code is as below ,

| savedsearch Saved_Search
| eval total_count=Compliant+NonCompliant
| eval Compliancepercent=round(100*'Compliant'/total_count,2)
| eval Noncompliancepercent=round(100*'NonCompliant'/total_count,2)
| eval NonCompliance9x=if(Noncompliancepercent&gt;90 and Noncompliancepercent&lt;95,Noncompliancepercent,null())
| eval NonComplianceRest=if(Noncompliancepercent&lt;90 or Noncompliancepercent&gt;95,Noncompliancepercent,null())
| table trmsc Compliancepercent NonCompliance9x NonComplianceRest

SplunkTrust
Explorer

Thank you Jagani .

But this didnt give any change to by chart .

i tried like

| eval yellowCount=case('Non Compliance %' < 10.00 AND 'Non Compliance %' >5.00,yellowCount."Yellow",true(),yellowCount)

|stats count by trmsc "Compliance %" "Non Compliance %" yellowCount

|fields - sort_field Compliant NonCompliant total_count count

Please suggest me a way .

Tags (1)
SplunkTrust

What @VatsalJagani meant is for you to read the linked solution, which really comes down to <option name="charting.fieldColors" />.  You need to open Source to edit.  See General chart properties; you can also see an example in Specify custom colors for fields in charts. (Thanks to Jagani's pointer, I get to apply custom color myself!)

SplunkTrust

That is correct. Thanks @yuanliu

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...