Splunk Search

Timechart Cell value replace numeric value by conditional string

rishiaggarwal
Explorer

Hi All, i am newbie to Splunk and need an assistance in writing a splunk dashboard where i wish to replace the average transaction duration value with a range string. For eg. if the Transaction duration is between 0-6 sec, rather then displaying an actual average duration (number) it should display a text "Green".

Condition : 0-6 Green , 7-20 Amber, >20 Red

Draft Query is given below.

index=XXX_XXX  sourcetype=XXX_YYY source=YXYX_YCYC 
Search String 
| transaction correlationId keepevicted=true 
| timechart span=5m avg(duration) as response_health by activityName
| convert ctime(_time) as _time timeformat="%H:%M %p"  
| fillnull 

alt text

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try this

<your search>|untable _time activityName response_health|eval color=case(response_health==0 AND response_health<7,"Green",response_health> 6 AND response_health<21,"Amber" ,1=1,"Red")|xyseries _time activityName color

Instead of 1=1, you can provide response_heath>20 and give another default value in case the other three conditions are not matched.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try this

<your search>|untable _time activityName response_health|eval color=case(response_health==0 AND response_health<7,"Green",response_health> 6 AND response_health<21,"Amber" ,1=1,"Red")|xyseries _time activityName color

Instead of 1=1, you can provide response_heath>20 and give another default value in case the other three conditions are not matched.

Happy Splunking!
0 Karma

rishiaggarwal
Explorer

Thanks a heap. This solution worked for me.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...