Splunk Search

Bar color based on value

marellasunil
Communicator

I have a table with values & host names. I wanted to take avg of all values by host and to create a bar chart, If the average value exceeding the limit, the bar should be green else it should be red, and also on mouse-over on the bar avg value should be displayed.

Query : sourcetype=XXXXX | chart avg(value) by Server
For ex
Host Value
Server1 20
Server2 22
Server1 19
Server2 26

I wanted average values of server1, and if it crosses 80, bar for server should be red else green, same for server2 as well.

Kindly help.

0 Karma
1 Solution

marellasunil
Communicator

.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value

Then I have used "charting.fieldColors" in dashboard XML

View solution in original post

0 Karma

marellasunil
Communicator

.. | chart avg(value) as value by Server | eval "3 Red"=if(value>=90,value, 0) | eval "2 Amber"=if(value<90 AND value>=80, value , 0) | eval "1 Green"=if(value <80, value ,0) | fields - value

Then I have used "charting.fieldColors" in dashboard XML

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...