Splunk Search

pie chart color with condition

surekhasplunk
Communicator
|inputlookup vrf_usage.csv | search VRF="PCOM"| search VLAN="Vlan802" | table VLAN device capacity free used

VLAN            device       capacity   free    used
Vlan802 DC2A3-CLOUD-CFD-VDC2    2048    1596    452
Vlan802 DC2A4-CLOUD-CFD-VDC2    2048    1594    454
Vlan802 SC2BJV-CLOUD-CFD-VDC2   2048    1882    166
Vlan802 SC2CLK-CLOUD-CFD-VDC2   2048    1883    165
Vlan802 TIGR6-CLOUD-CFD-VDC2-A1 2048    1838    210
Vlan802 TIGR6-CLOUD-CFD-VDC2-A2 2048    1838    210

Now i need a pie chart to show in RED color the used part and in GREEN color the free part

how can i achieve this in pie chart.

and if i select VLAN=* then it should sum all VLAN used and show in red and sum of all VLAN free and show in green

Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

<dashboard>
  <label>pie chart</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>|inputlookup vrf_usage.csv | search VRF="PCOM"| search VLAN="Vlan802" | table VLAN device capacity free used 
| chart sum(free) as free, sum(used) as used | transpose</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.seriesColors">[#008000,#FF0000]</option>
      </chart>
    </panel>
  </row>
</dashboard>

or

    <dashboard>
      <label>pie chart</label>
      <row>
        <panel>
          <chart>
            <search>
              <query>|inputlookup vrf_usage.csv | search VRF="PCOM"| search VLAN="Vlan802" | table VLAN device capacity free used 
    | chart sum(free) as free, sum(used) as used | transpose</query>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </search>
            <option name="charting.chart">pie</option>
            <option name="charting.drilldown">none</option>
            <option name="charting.fieldColors">{"used":#FF0000,"free":#008000}</option>
          </chart>
        </panel>
      </row>
    </dashboard>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

<dashboard>
  <label>pie chart</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>|inputlookup vrf_usage.csv | search VRF="PCOM"| search VLAN="Vlan802" | table VLAN device capacity free used 
| chart sum(free) as free, sum(used) as used | transpose</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.seriesColors">[#008000,#FF0000]</option>
      </chart>
    </panel>
  </row>
</dashboard>

or

    <dashboard>
      <label>pie chart</label>
      <row>
        <panel>
          <chart>
            <search>
              <query>|inputlookup vrf_usage.csv | search VRF="PCOM"| search VLAN="Vlan802" | table VLAN device capacity free used 
    | chart sum(free) as free, sum(used) as used | transpose</query>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </search>
            <option name="charting.chart">pie</option>
            <option name="charting.drilldown">none</option>
            <option name="charting.fieldColors">{"used":#FF0000,"free":#008000}</option>
          </chart>
        </panel>
      </row>
    </dashboard>
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...