I want to color the column bars based on the Status value I'm getting, having trouble in doing that. Can anyone help me in this.
Here's my code:
<chart>
<search>
<query>index=home sourcetype=data | eval Status=substr(HEADER,-1) | Eval Status= if(Status=="C","Complete",if(Status=="S","Received",if(Status=="R","Response"," ")))| chart count as Count by Status</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"Received":0xFF0000,"Response":0xFFFF00, "Complete":0x73A550}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.axisTitleX.text">Status</option>
<option name="refresh.auto.interval">600</option>
<option name="charting.chart.overlayFields">cumulative</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.axisTitleY.text">Count</option>
</chart>
Try changing your query to this
index=home sourcetype=data
| eval Status=substr(HEADER,-1)
| stats count by Status
| eval Complete=if(Status="C", count, 0)
| eval Received=if(Status="S", count, 0)
| eval Response=if(Status="R", count, 0)
Try changing your query to this
index=home sourcetype=data
| eval Status=substr(HEADER,-1)
| stats count by Status
| eval Complete=if(Status="C", count, 0)
| eval Received=if(Status="S", count, 0)
| eval Response=if(Status="R", count, 0)
Thanks. That works.