Splunk Search

How do I change the font color in a chart depending on a value?

jmauritz
New Member

Hello,

I try to change the font colour within a chart. Unfortunately I can only create dashboards and don't have any admin rights. Here is my search:

index=int  Up
| rex field=_raw "Up (?.*) \((?.*)\);(?.*);(?.*);(?.*)"
| chart values(status) BY host name useother=false

I would like to have the font color green if the values(status) is "healthy" and red if the values(status) is "unhealthy". Unfortunately, I can't change the color directly at the field, because the field names are also dynamic (name).

Do you have any idea how I can manage this ?

Thank you in advance for your support

Julia

0 Karma

jmauritz
New Member

alt text

Here is a printscreen from the statistic. Maybe this helps. I think because the field name is a variable I can't change the color of the field depending on his value. Am I right ?

0 Karma

niketn
Legend

@jmauritz is this for Table visualization or Chart? What does your current visualization look like and what is the expected output? If you can add a screenshot/mock up for both that would be great for the community members to assist.

If you are looking for color based on values like health or unhealthy you can use Table visualization and Color based on cell value which is available in version 6.5 and higher. The same can be done either directly via UI > Edit > Format Visualization > Edit Table Column > Table Cell Color by Value or else using table Simple XML configuration.

On separate notes, while posting the code use the code button i.e. 101010 or shortcut Ctrl+G, to ensure that special characters do not escape. As per your current code what if a host has both values health and unhealthy for the same host.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dkeck
Influencer
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...