Splunk Search

colour format in chart based on the list

iamniks
Explorer

Hi, I have a table

DATE AMOUNT
07/22/2014 1000
07/23/2014 2000
08/01/2014 500

and so on.

I have to get a bar chart of decreasing amount and date. which is easy. Now i have to represent the latest date in that chart in a different colour. Is that possible

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try.

Your search giving fields DATE, AMOUNT | eval LATEST=strptime(DATE,"%m/%d/%Y") 
| eventstats max(LATEST) as LATEST1 | eval LATESTAMT=if(LATEST=LATEST1,AMOUNT,0) | eval AMOUNT=if(LATEST=LATEST1,0,AMOUNT)| table DATE, AMOUNT, LATESTAMT 

Use this to generate a stacked bar chart and for the latest record it should show in different color (with different series name 'LATESTAMT')

0 Karma

iamniks
Explorer

many. it will keep updating the list on when a transaction happens on that date. so i need a query to find the latest date in the list at any point in time

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How many rows can be there in the table?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi iamniks,

Yes, you can do this - but you need to tweak some css and js files to achieve this. See this http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values or this app http://apps.splunk.com/app/570/.

hope this helps ...

cheers, MuS

0 Karma

iamniks
Explorer

thanks for the response but we can use the above if we know what is the expected value but in my case i dont know what is the latest date in the list

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...