Splunk Search

Timechart Cell value replace numeric value by conditional string

rishiaggarwal
Explorer

Hi All, i am newbie to Splunk and need an assistance in writing a splunk dashboard where i wish to replace the average transaction duration value with a range string. For eg. if the Transaction duration is between 0-6 sec, rather then displaying an actual average duration (number) it should display a text "Green".

Condition : 0-6 Green , 7-20 Amber, >20 Red

Draft Query is given below.

index=XXX_XXX  sourcetype=XXX_YYY source=YXYX_YCYC 
Search String 
| transaction correlationId keepevicted=true 
| timechart span=5m avg(duration) as response_health by activityName
| convert ctime(_time) as _time timeformat="%H:%M %p"  
| fillnull 

alt text

0 Karma
1 Solution

renjith_nair
Legend

Try this

<your search>|untable _time activityName response_health|eval color=case(response_health==0 AND response_health<7,"Green",response_health> 6 AND response_health<21,"Amber" ,1=1,"Red")|xyseries _time activityName color

Instead of 1=1, you can provide response_heath>20 and give another default value in case the other three conditions are not matched.

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Try this

<your search>|untable _time activityName response_health|eval color=case(response_health==0 AND response_health<7,"Green",response_health> 6 AND response_health<21,"Amber" ,1=1,"Red")|xyseries _time activityName color

Instead of 1=1, you can provide response_heath>20 and give another default value in case the other three conditions are not matched.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

rishiaggarwal
Explorer

Thanks a heap. This solution worked for me.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...