Dashboards & Visualizations

Change the color of a line representing one series based on another series

larrouils
New Member

Hi, I am sorry if this has been asked previously.
In effect, I look for a number of current day wires, and compare that to wires a week ago.
I need to display current day wires (Total_Today) as a line chart and change the color of the line based on a calculation (at present it is a percentage but this may change). These are repesented by eval greencCount, redCount, YellowCount.
Any help is truly appreciated.


index= IndexA source="SourceA" TRXTYPE="Wires" earliest=-0@d latest=now
| timechart span=1h count by TRXTYPE limit=25
| accum "Wires" as accum_Total_Today
| timechart last(accum_*) as * span=1h

| appendcols
[search index=IndexA source="SourceA" TRXTYPE="Wires" earliest=-7d@d enddaysago=7
| timechart span=1h count by TRXTYPE limit=25
| accum "Wires" as accum_Total_Week_Ago
| timechart last(accum_*) as * span=1h | eval _time=_time+(604800)
] | eval greenCount = if(Total_Today >= Total_Week_Ago,Total_Today,0)
| eval yellowCount = if(Total_Today < Total_Week_Ago AND Total_Today/Total_Week_Ago*100 <=70,Total_Today,0)
| eval redCount = if(Total_Today < Total_Week_Ago AND Total_Today/Total_Week_Ago*100 >70, Total_Today, 0)
| table _time Total_Today


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...