Splunk Search

How to configure different color codes for Today and Yesterday to display a comparative trend timechart?

Venkat_16
Contributor

Hi

I am trying to create a comparative trend chart for Today and yesterday, but i have problem with the visualization. i need to make sure all the Today data have one color and all the Yesterday have another color. So the table would look like:

_time    Today:XXXX   Today:XXXX   Yesterday:XXXX   Yesterday:XXXX
10:05        25           30            25                22
10:10        22           23            22                24
10:15        10           12            11                13

Here XXXX-> represent integers (they aren't static and generate new numbers every 5 mins)

Tags (3)
0 Karma

chimell
Motivator

Hi Venkat_16
If you are sure that the query above is yours then copy and paste the following xml code in a view and test

<dashboard>
<label>enter something</label>
<input type="time" token="time_tok" searchWhenChanged="true">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
 <row>
  <chart>
        <title>Field colors example</title>
        <search>
          <query>
index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID
          </query>
          <earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
        </search>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.fieldColors">
          {"thisDay ": 0xFF0000, "LastDay ": 0xFF9900, "Today":0x0066FF, "Yesterday":0xC4C4C0 ,"NULL":0xC4EFC0}
        </option>
        <option name="charting.legend.placement">right</option>
      </chart>
  </row>
</dashboard>

chimell
Motivator

Hi Venkat_16
have you test the xml code above ? If no let test and see

0 Karma

stephanefotso
Motivator

Hello! Lets get the search you are using to build your table?

SGF
0 Karma

Venkat_16
Contributor

index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID

0 Karma

stephanefotso
Motivator

Are you sure your query is the one giving the table above? Please let me get some of your ID's values.
Thanks

SGF
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...