Splunk Dev

How to change color of particular column?

SCSC
Explorer

I made the column chart like this images.

I want to change the color of particular column specified by field "No." , that is as "token" by other graph.

My ideal is third image.

 

I'm sorry if my English is wrong.

SCSC_0-1656400939030.png

SCSC_2-1656401032704.png

SCSC_3-1656401567278.png

 

 

0 Karma
1 Solution

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




View solution in original post

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




SCSC
Explorer

I understand.

Thanks for reply 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...