Alerting
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How to set status color from xyseries values?

karthi2809
Builder
‎07-07-2020 06:19 AM 
index=xx* app_name="xxx" OR cf_app_name="yyy*" OR app_name="ccc"
|bucket _time span=1d |eval dayweek=strftime(_time,"%H")
|convert timeformat="%m-%d-%y" ctime(_time) as c_time
|eval Job = case(like(msg, "%first%"), "first Job", like(msg, "%second%"), "second Job", like(msg, "%third%"), "third job",like(msg, "%fourth%"), "fourth job")| stats count(eval(like(msg, "%All feed is completed%") OR like(msg, "%Success:%") OR like(msg, "%Success: %") OR like(msg, "%Finished success%"))) as Successcount count(eval(like(msg, "%Fatal Error: %") OR like(msg, "%Fatal Error:%") OR like(msg, "%Job raised exception%") AND like(msg, "% job error%"))) as failurecount by Job c_time dayweek
|eval status=case((Job="fourth job") AND (dayweek=="Saturday" OR dayweek=="Sunday"),"NA",Successcount>0,"Success",failurecount>0,"Failure")
| xyseries Job c_time status

My result :

Jobdate1date2date3
firstSuccessSuccessFailure
secondSuccessSuccessSuccess

 

Set status color success as green and failure as red but its comes from xyseries c_time so i cant able to set color.

Labels (1)
Labels
Tags (2)
Reply

thisissplunk
Builder
‎09-23-2021 07:42 PM

Actually I just figured it out. The key is using nothing in the field value:

 

 

<format type="color" field="">
   <colorPalette type="minMidMax" maxColor="#31A35F" midColor="#A2CC3E" minColor="#FFFFFF"></colorPalette>
   <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
</format>

 

 

 

Then reformatting the left most column back to default in the panel:

 

 

 

      <html depends="$alwaysHideCSSStyle$">
        <style>
            #YOURTABLEID tbody td[data-cell-index="0"] {
               background-color: #e1e6eb !important;
               color: #000000 !important;
            }
        </style>
    </html>

 

 

 

However, this isn't perfect because the heat coloring only compares itself to other items in their respective column. Not any value throughout the entire table.

Edit: Ignore the first part above and just set this in your xyseries table in your dashboard.

thisissplunk_0-1632452945138.png

If your left most column are number values and are being counted in the heatmap, go add the html piece above to fix that, or eval some strings onto the front or back of it. I can't tell if the heatmap is considering those values in it's auto gradient calculation or not.

0 Karma
Reply

thisissplunk
Builder
‎09-23-2021 06:29 PM

I would also like to know. If you can color the values, suddenly it's a heatmap.

0 Karma
Reply
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...