Splunk Search

Timechart Cell value replace numeric value by conditional string

rishiaggarwal
Explorer

Hi All, i am newbie to Splunk and need an assistance in writing a splunk dashboard where i wish to replace the average transaction duration value with a range string. For eg. if the Transaction duration is between 0-6 sec, rather then displaying an actual average duration (number) it should display a text "Green".

Condition : 0-6 Green , 7-20 Amber, >20 Red

Draft Query is given below.

index=XXX_XXX  sourcetype=XXX_YYY source=YXYX_YCYC 
Search String 
| transaction correlationId keepevicted=true 
| timechart span=5m avg(duration) as response_health by activityName
| convert ctime(_time) as _time timeformat="%H:%M %p"  
| fillnull 

alt text

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try this

<your search>|untable _time activityName response_health|eval color=case(response_health==0 AND response_health<7,"Green",response_health> 6 AND response_health<21,"Amber" ,1=1,"Red")|xyseries _time activityName color

Instead of 1=1, you can provide response_heath>20 and give another default value in case the other three conditions are not matched.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try this

<your search>|untable _time activityName response_health|eval color=case(response_health==0 AND response_health<7,"Green",response_health> 6 AND response_health<21,"Amber" ,1=1,"Red")|xyseries _time activityName color

Instead of 1=1, you can provide response_heath>20 and give another default value in case the other three conditions are not matched.

Happy Splunking!
0 Karma

rishiaggarwal
Explorer

Thanks a heap. This solution worked for me.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...