How to configure different color codes for Today and Yesterday to display a comparative trend timechart?

[Venkat_16]

Hi

I am trying to create a comparative trend chart for Today and yesterday, but i have problem with the visualization. i need to make sure all the Today data have one color and all the Yesterday have another color. So the table would look like:

_time    Today:XXXX   Today:XXXX   Yesterday:XXXX   Yesterday:XXXX
10:05        25           30            25                22
10:10        22           23            22                24
10:15        10           12            11                13

Here XXXX-> represent integers (they aren't static and generate new numbers every 5 mins)

[chimell]

Hi Venkat_16
If you are sure that the query above is yours then copy and paste the following xml code in a view and test

<dashboard>
<label>enter something</label>
<input type="time" token="time_tok" searchWhenChanged="true">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
 <row>
  <chart>
        <title>Field colors example</title>
        <search>
          <query>
index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID
          </query>
          <earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
        </search>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.fieldColors">
          {"thisDay ": 0xFF0000, "LastDay ": 0xFF9900, "Today":0x0066FF, "Yesterday":0xC4C4C0 ,"NULL":0xC4EFC0}
        </option>
        <option name="charting.legend.placement">right</option>
      </chart>
  </row>
</dashboard>

[chimell]

Hi Venkat_16
have you test the xml code above ? If no let test and see

[stephanefotso]

Hello! Lets get the search you are using to build your table?

[Venkat_16]

index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID

[stephanefotso]

Are you sure your query is the one giving the table above? Please let me get some of your ID's values.
Thanks