I know someone is going to say this has been answered many times but...I have gone through every example I can find here in the Community and have yet to find something that will work. I have a monitor that runs every 5 minutes to validate a web URL is alive and it records the number of milliseconds for the total response time. My query returns two values _time and total_time for each 5 minute ping. I can use the "pencil" on the right to add color and ranges to the table display but it does not flow into visualization. My search: index=xxx_website_monitoring sourcetype=web_ping https://my.website.com | stats values(total_time) by _time The column chart works but I need to make each column Green, Yellow or Red based on the value of total_time like: | eval red = if(total_time>=500,total_time,0) | eval yellow = if(total_time<500 AND total_time>=300,total_time,0) | eval green = if(total_time<300, total_time, 0) However, none of the examples I have found work because they expect Func(Expression) or if([bool expr], [expr], or some other command combination and not just a Field. Here is the chart with the default Blue. total_response on the Y and _time on the X: Here is an example of what does not work: index=xxx_website_monitoring sourcetype=web_ping https://my.website.com | stats values(total_time) by _time | eval red = if(total_time>=500,total_time,0) | eval yellow = if(total_time<500 AND total_time>=300,total_time,0) | eval green = if(total_time<300, total_time, 0) <chart> <searchName>URLMonitor</searchName> <title>Clarifire URL Response Times</title> <option name="charting.chart">column</option> <option name="charting.fieldColors">{"red":0xFF0000,"yellow":0xFFFF00, "green":0x73A550}</option> <option name="charting.legend.placement">none</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option> </chart> Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).
... View more