Splunk Search

How to create a bar chart where the bar colors change dynamically if they are above or below an SLA line?

neilhiley
Explorer

Hi.

I have a bar chart that shows an SLA line and response times for today and the previous day. What I want is when the SLA is breached, the bar should turn red. and anything under should be green.

My code is like this so far.

<query>host=* index="sla" source="/SLA/SLA_2_2_2_10-11/*" |  timechart span=1d max(msecs) AS Max_avg | streamstats current=f global=f window=1 latest(Max_avg) as previous_day_avg | eval ratio=round(Max_avg/previous_day_avg,2) | eval SLA=150</query>
          <earliest>@mon</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
        <option name="charting.axisTitleX.text">Date</option>
        <option name="charting.axisTitleY.text">Response Time (secs)</option>
        <option name="charting.chart.overlayFields">SLA</option>
      </chart>
Tags (4)

dijikul
Communicator

Did you find a solution to this? We're trying to style area charts so the Y-Axis fades from one colour to another based on values...

0 Karma

gfreitas
Builder

I think the easiest way to achieve that is to use a radial gauge graph and format the color ranges. To change the bar chart color dynamically you should do some programing..

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...