Dashboards & Visualizations

How to display certain colors in a graph based on certain values?

splunkman341
Communicator

Hey guys,

So I currently have a graph which utilizes how much disk space a certain path is taking up on a certain server. Since there are several servers with different disk utilizations, the graph is all over the place with all different kinds of colors. So, what I want to do is color code the graphs based on their values of disk utilization. To be more specific, I want the servers with less than 50% of utilization to be green, the servers with 50-70% utilization to be yellow, and the servers with over 70% utilization to be shown as red.

Can someone help out?

Thanks in advance for your tips and help!

Tags (3)
0 Karma

woodcock
Esteemed Legend

What is your current search command?

0 Karma

splunkman341
Communicator
index="tablet_os" sourcetype="df" host=dc1* sda3 OR Data
| multikv fields FileSystem, UsePct | strcat host '@' Filesystem Host_FileSystem
| eval Host_FileSystem = case(
   Host_FileSystem = "dc1prmtbap01/dev/mapper/localraid-Data", "dc1prmtbap01 /data",
   Host_FileSystem = "dc1prmtbap01 /dev/sda3", "dc1prmtbap01/root",
   Host_FileSystem = "dc1prmtbap02/dev/mapper/localraid-Data", "dc1prmtbap02 /data",
   Host_FileSystem = "dc1prmtbap02 /dev/sda3", "dc1prmtbap02/root",
   Host_FileSystem = "dc1prmtbap03/dev/mapper/localraid-Data", "dc1prmtbap03 /data",
   Host_FileSystem = "dc1prmtbap03 /dev/sda3", "dc1prmtbap03/root",
   Host_FileSystem = "dc1prmtbap04/dev/mapper/localraid-data", "dc1prmtbap04 /data",
   Host_FileSystem = "dc1prmtbap04 /dev/sda3", "dc1prmtbap04/root",
   Host_FileSystem = "dc1prmtbap05/dev/mapper/localraid-data", "dc1prmtbap05 /data",
   Host_FileSystem = "dc1prmtbap05 /dev/sda3", "dc1prmtbap05/root" ,
   1=1,  Host_FileSystem)
| timechart span=60m avg(UsePct) by Host_FileSystem
| rename avg(UsePct) as %Used
0 Karma

jmallorquin
Builder

Hi,

I think this will be helpfull for you

http://docs.splunk.com/Documentation/Splunk/6.1/Viz/BuildandeditdashboardswithSimplifiedXML#Specify_...

Specify custom colors for fields in charts

{"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x009900, "NULL":0xC4C4C0}

Regards

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...