Splunk Search

color of column chart

surekhasplunk
Communicator

alt text

I have a graph like this. Now i want to highlight and make red only if Available value is less than 100 in the x axis.
how to do that.

Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try like and adjust as per your requirement

<dashboard>
  <label>chart color</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="_internal" |stats count by source | eval redCritical = if(count<= 10000,count ,0) | eval yellowWarning = if(count>= 10001,count ,0)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.labels">[redCritical,yellowWarning]</option>
     <option name="charting.seriesColors">[0xFF0000,0xFFFF00]</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try like and adjust as per your requirement

<dashboard>
  <label>chart color</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="_internal" |stats count by source | eval redCritical = if(count<= 10000,count ,0) | eval yellowWarning = if(count>= 10001,count ,0)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.labels">[redCritical,yellowWarning]</option>
     <option name="charting.seriesColors">[0xFF0000,0xFFFF00]</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...