Hi,
I have created a dashboard panel which lists out top actions taken by a Palo Alto firewall. The Action field takes values - pass, reject, drop & allow. I want to use different colors for the different bars. Below mentioned is the XML code which I am using, which is not returning the results I am expecting. Please help me rewrite the eval function.
<dashboard>
<label>Palo Alto Firewall Action Summary</label>
<row>
<panel>
<chart>
<title>Action Summary</title>
<searchString>source="PaloAlto.csv"| top limit=20 Action
| eval redCount=searchmatch("reject")
| eval yellowCount=searchmatch("pass")
| eval greenCount=searchmatch("allow")
| eval orangeCount=searchmatch("drop")
</searchString>
<earliestTime>0</earliestTime>
<latestTime/>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="charting.fieldColors">{"redCount":0xFF0000,"yellowCount":0xFFFF00,"greenCount":0x73A550,"orangeCount":0xFF6600}</option>
</chart>
</panel>
</row>
</dashboard>
Hello!
I tryed to see what you have done and i saw certain errors in your code.
See bellow, your same code updated, and i think it should help you understand what to do. just test it, i hope it is working properly.
Here my group field takes values-pipeline and deploy-server. i will use red color for pipeline values and yellow color for deploy values.
<dashboard>
<label>Color bars with Eval</label>
<row>
<panel>
<chart>
<searchString>index=_internal group=* |eval redCount=case(searchmatch("pipeline"),"y")|eval yellowCount=case(searchmatch("deploy-server"),"x")|stats count(redCount) AS redCount, count(yellowCount) AS yellowCount by group</searchString>
<earliestTime>0</earliestTime>
<latestTime/>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="charting.fieldColors">{"redCount":0xFF0000,"yellowCount":0xFFFF00}</option>
</chart>
</panel>
</row>
</dashboard>