I have a table with values & host names. I wanted to take avg of all values by host and to create a bar chart, If the average value exceeding the limit, the bar should be green else it should be red, and also on mouse-over on the bar avg value should be displayed.
Query : sourcetype=XXXXX | chart avg(value) by Server
For ex
Host Value
Server1 20
Server2 22
Server1 19
Server2 26
I wanted average values of server1, and if it crosses 80, bar for server should be red else green, same for server2 as well.
Kindly help.
.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value
Then I have used "charting.fieldColors" in dashboard XML
.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value
Then I have used "charting.fieldColors" in dashboard XML