- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
michaelnorup
Communicator
02-17-2022
11:07 PM
Hey guys.
So i have a search which created a bar chart
| rex field=_raw "(.Net Version is)\s+(?<DotNetVersion>.+)"
| stats latest(DotNetVersion) as DotNetVersion by host
| fillnull value="-"
| eval status=case(match(DotNetVersion,"Not!"),"noncompliant",1=1,"Compliant")
| chart count by status
I have tried most options in the xml but i cant get it to be green/red =/
Any ideas? Thought the ".fieldColors" would do the trick, but i think maybe my field is called "count" instead of Compliant/noncompliant
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
02-18-2022
01:07 AM
You need a (dummy) x-axis dimension
| eval label="count"
| chart count by label status
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
02-17-2022
11:49 PM
Try seriesColors
<option name="charting.seriesColors">[#53A051,#DC4E41]</option>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
michaelnorup
Communicator
02-18-2022
12:36 AM
This works if i change it to a pie chart, but it changed both colors in the bar chart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
02-18-2022
01:07 AM
You need a (dummy) x-axis dimension
| eval label="count"
| chart count by label status
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
02-18-2022
12:45 AM
Try this
| stats count by status
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
michaelnorup
Communicator
02-18-2022
12:51 AM
Nope =/
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)