Hi,
I'm trying to figure out a way to change the color of one of the bars in a series to RED if that bar happens to be the highest value vs all the rest of the bars.
I see where you can change the color if the value is in between x and y and that is helpful to learn how the color change can happen, I'm just having trouble figuring out how to get to the highest value.
Give this a try (and use the stacked in the chart's general properly)
index=top10 source=/home/oracle/workdir/account_log.csv OR source=/home/oracle/workdir/reboots_requests_summary.csv |where OBJECT_TYPE="reboot" AND DIFF=""|eval TICKET_CODE_TEXT=case(TICKET_CODE==15395,"15395-Offline Frozen",TICKET_CODE==15396,"15396-Offline Black Screen",TICKET_CODE==15397,"15397-Offline Stuck Booting",TICKET_CODE==15398,"15398-Offline Operational",TICKET_CODE==15399,"15399-Online Frozen",TICKET_CODE==15400,"15400-Online Black Screen",TICKET_CODE==15401,"15401-Online Stuck Booting")|stats dc(PREMISE) as "PREMISE COUNT" by TICKET_CODE_TEXT|sort -"PREMISE COUNT" | eventstats max("PREMISE COUNT") as "PREMISE COUNT (MAX)" | eval "PREMISE COUNT(MAX)"=if('PREMISE COUNT'='PREMISE COUNT (MAX)','PREMISE COUNT (MAX)',0) | eval "PREMISE COUNT"=if('PREMISE COUNT'='PREMISE COUNT (MAX)',0,'PREMISE COUNT')
Interesting idea. Gets closer but it seems to add the first column to all the data points instead of it being just the first one
Sure!!!
index=top10 source=/home/oracle/workdir/account_log.csv OR source=/home/oracle/workdir/reboots_requests_summary.csv |where OBJECT_TYPE="reboot" AND DIFF=""|eval TICKET_CODE_TEXT=case(TICKET_CODE==15395,"15395-Offline Frozen",TICKET_CODE==15396,"15396-Offline Black Screen",TICKET_CODE==15397,"15397-Offline Stuck Booting",TICKET_CODE==15398,"15398-Offline Operational",TICKET_CODE==15399,"15399-Online Frozen",TICKET_CODE==15400,"15400-Online Black Screen",TICKET_CODE==15401,"15401-Online Stuck Booting")|stats dc(PREMISE) as "PREMISE COUNT" by TICKET_CODE_TEXT|sort -"PREMISE COUNT"
Ok little bit of an update. I figured out that I can sort the results so that the first bar will always be the highest value. Which is closer to what I'm looking for. How can I change the color of the 1st bar but only the first bar?
Can you post your current search?