Hey guys.
So i have a search which created a bar chart
| rex field=_raw "(.Net Version is)\s+(?<DotNetVersion>.+)"
| stats latest(DotNetVersion) as DotNetVersion by host
| fillnull value="-"
| eval status=case(match(DotNetVersion,"Not!"),"noncompliant",1=1,"Compliant")
| chart count by status
I have tried most options in the xml but i cant get it to be green/red =/
Any ideas? Thought the ".fieldColors" would do the trick, but i think maybe my field is called "count" instead of Compliant/noncompliant
You need a (dummy) x-axis dimension
| eval label="count"
| chart count by label status
Try seriesColors
<option name="charting.seriesColors">[#53A051,#DC4E41]</option>
This works if i change it to a pie chart, but it changed both colors in the bar chart
You need a (dummy) x-axis dimension
| eval label="count"
| chart count by label status
Try this
| stats count by status
Nope =/