Hi All,
Have searched for many months and unable to locate what i need. something i believe should be so simple is alluding me..looking for some help on this.
I am trying to change the colour o...
See more...
Hi All,
Have searched for many months and unable to locate what i need. something i believe should be so simple is alluding me..looking for some help on this.
I am trying to change the colour of a bar / column chart to represent a different colour per the size of the shop and showing how many alarm incidents they have had. Visually this should allow me to see a comparison of alerts across my Large shops / my Small Shops by looking at a color only and not having to remember each shops size. ie all green shops are small.
My test table is as followed : On my Graph i would like for the Size of the Shop to be color coded - Large - blue, Medium-yellow, Small-green ( the color of the 3 sizes i am not fussy on) .
Shop
Size
TypeReport
NoEvents
A
Large
FrontAlarm
76
A
Large
BackAlarm
115
B
Small
FrontAlarm
37
B
Small
BackAlarm
132
C
Medium
FrontAlarm
81
C
Medium
BackAlarm
39
D
Large
FrontAlarm
159
D
Large
BackAlarm
110
E
Small
FrontAlarm
26
E
Small
BackAlarm
71
F
Medium
FrontAlarm
113
F
Medium
BackAlarm
49
I have tried several Evals but just do not see to be able to get this right. I have tried to follow several answers within the splunk community on this topic, but due to the answers evaluating time - its throwing me out and thus losing that last piece to the puzzle - i have been trying things such as -
| inputlookup Testcolor.csv | search TypeReport="FrontAlarm" | stats count by NoEvents | eval {NoEvents}=count | fields - count
and changing the source with the below but still no luck.
<option name="charting.fieldColors">{"A":#32a838,"B":#006D9C,"C":#006D9C,"D":#32a838,"E":#006D9C,"F":#006D9 }</option>
To even trying
| inputlookup Testcolor.csv | search TypeReport="FrontAlarm"
| stats count by NoEvents
| eval Shop="A, B, C, D, E, F"
| makemv Shop delim=","
| mvexpand Shop
| eval count=NoEvents
| table Shop count
| eval {Shop}=count
| fields - count
The above Seemed to get me close but no cigar. I have another 6 weeks before i really need to figure this out, any help would be appreciated. ( Id also prefer to build this in dashboard studio if that does help my problem - i am also only using static data so times are pulled in)
Cheers