Splunk Dev

How to change color of particular column?

SCSC
Explorer

I made the column chart like this images.

I want to change the color of particular column specified by field "No." , that is as "token" by other graph.

My ideal is third image.

 

I'm sorry if my English is wrong.

SCSC_0-1656400939030.png

SCSC_2-1656401032704.png

SCSC_3-1656401567278.png

 

 

0 Karma
1 Solution

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




View solution in original post

nadlurinadluri
Communicator

Not a straight forward answer, but you can move that particular value to a different field (new field) and have all the other values as 0.

Something like below,

| makeresults 
| eval field1="10,12,11,13,14,12,25,16,15,11,14" 
| makemv delim="," field1
| mvexpand field1
| eval SNO=1
| accum SNO
| eval _time=_time+(100*SNO)
| table _time field1
| eval newfield2=if(field1>20,field1,0)
| eval newfield1=if(field1>20,0,field1)
| table _time newfield1 newfield2




SCSC
Explorer

I understand.

Thanks for reply 🙂

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...