Splunk Search

How to change the stacked bar chart color based on percentage?

sundarhcl_2022
Explorer

Hi,

 I have Percentage calculated for Compliance and Non Compliance based on the data .Now i need to segregate it based on colors in staked bar chart.

Now ,the for all Non Comp % between 90 to 95 should be shown in yellow and rest should be in red .The  Non compliance is 95 to 100.

Please let me know the search for this .My search

| savedsearch_Saved_Search
| eval total_count=Compliant+NonCompliant
| eval "Compliance %"=round(100*'Compliant'/total_count,2)
| eval "Non Compliance %"=round(100*'NonCompliant'/total_count,2)

|stats count by msc "Compliance %" "Non Compliance %" 
Labels (1)
Tags (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

Well, what can I say... works for me.

PickleRick_0-1644920811740.png

Unless you wanted something else completely but that's what I understood.

 

View solution in original post

PickleRick
Ultra Champion

I don't understand, to be frank, what you want to achieve.

This last stats count is a complete mystery to me.

If you just count the compliance/non compliance percentages, it's also not very clear. You want to have a row of collumns stacking up to 100%? (because compliant + non-compliant should sum up to total_count).

And as far as I know you have different colours for different data series. You can't conditionally colour the same dataseries elements. At least not with the built-in visualization.

You could however do a "trick" and separate Non-compliance into two separate series

| eval total_count=Compliant+NonCompliant
| eval CompliancePercent=round(100*'Compliant'/total_count,2)
| eval NonCompliancePercent=round(100*'NonCompliant'/total_count,2)
| eval NonCompliance9x=if(NonCompliancePercent>90 and NonCompliancePercent<95,NonCompliancePercent,null())
| eval NonComplianceRest=if(NonCompliancePercent<=90 OR NonCompliancePercent>=95,NonCompliancePercent,null())
| table msc "CompliancePercent" NonCompliance9x NonComplianceRest
0 Karma

sundarhcl_2022
Explorer

Thank you Rick,

the new color just applies on NonCompliant % but there is no change in chart for values between 90 to 95 .

Please let me know whether any thing can be altered.

 

0 Karma

PickleRick
Ultra Champion

Well, what can I say... works for me.

PickleRick_0-1644920811740.png

Unless you wanted something else completely but that's what I understood.

 

sundarhcl_2022
Explorer

It worked PickleRick .

Thank you .

Tags (1)
0 Karma

sundarhcl_2022
Explorer

Rick , 

Kindly let me know whether this can be achieved ,

when % is 0 to 90 then green 

when  %  is  90 to 95  then yellow

when  % is 95 to 100  then red 

 

 

0 Karma

PickleRick
Ultra Champion

As I said before - it's not a pretty solution because you're splitting the data into separate fields to have separate data series in the results and it's getting more ugly as you're adding additional "ranges" which in reality cause you to create new fields. But yes, you can do that.

Just as you had:

| eval NonCompliance9x=if(NonCompliancePercent>90 and NonCompliancePercent<95,NonCompliancePercent,null())
| eval NonComplianceRest=if(NonCompliancePercent<=90 OR NonCompliancePercent>=95,NonCompliancePercent,null())

You might as well do more of them:

| eval range0010=if(NonCompliancePercent<10,NonCompliancePercent,null())
| eval range1020=if(NonCompliancePercent>=10 AND NonCompliancePercent<20,NonCompliancePercent,null())
[... and so on ...]
This way you'll get separate data series which you'll be able to chart with different colours (and other of those range* data series will be empty at that point so they won't be charted - that's the trick).

You probably could wrap this into a macro or maybe even automate somehow but to be honest I don't have the capacity at the moment to look into it.

If it was only this parameter, you could also probably use bin stats and xyseries

0 Karma

sundarhcl_2022
Explorer

NonCompliance9x is the field not populating and hence i am not getting the  o/p expected . My code is as below ,

| savedsearch Saved_Search
| eval total_count=Compliant+NonCompliant
| eval Compliancepercent=round(100*'Compliant'/total_count,2)
| eval Noncompliancepercent=round(100*'NonCompliant'/total_count,2)
| eval NonCompliance9x=if(Noncompliancepercent&gt;90 and Noncompliancepercent&lt;95,Noncompliancepercent,null())
| eval NonComplianceRest=if(Noncompliancepercent&lt;90 or Noncompliancepercent&gt;95,Noncompliancepercent,null())
| table trmsc Compliancepercent NonCompliance9x NonComplianceRest

0 Karma

sundarhcl_2022
Explorer

Thank you Jagani .

But this didnt give any change to by chart .

i tried like 

| eval yellowCount=case('Non Compliance %' < 10.00 AND 'Non Compliance %' >5.00,yellowCount."Yellow",true(),yellowCount)

|stats count by trmsc "Compliance %" "Non Compliance %" yellowCount

|fields - sort_field Compliant NonCompliant total_count count

Please suggest me a way .

 

 

 

 

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

What @VatsalJagani meant is for you to read the linked solution, which really comes down to <option name="charting.fieldColors" />.  You need to open Source to edit.  See General chart properties; you can also see an example in Specify custom colors for fields in charts. (Thanks to Jagani's pointer, I get to apply custom color myself!)

0 Karma

VatsalJagani
Champion

That is correct. Thanks @yuanliu 

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...