hi
I need to use a different color the 5 series of my bar chart
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "Number" by cpu_range
I have tested many things with rangemap, charting.fieldColors or charting.seriesColors but nothing works!
is anybody can explain me what I have to do??
Thanks
@jip31 refer to one of my older answers to invert the series using transpose
command: https://answers.splunk.com/answers/548161/how-to-change-colour-of-graphs.html
Following is the query as per your use case. Once you have 5 columns as per CPU ranges defined, you can use charting.fieldColors
Simple XML Chart configuration option to have the ranges colored as per your needs.
| makeresults count=30
| fields - _time
| eval host="host", counter=1
| accum counter
| eval counter=printf("%02d",counter),host=host.counter
| fields - counter
| eval process_cpu_used_percent=random(), process_cpu_used_percent=substr(process_cpu_used_percent,1,2)
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "Number" by cpu_range
| append
[| makeresults
| fields - _time
| eval cpu_range="0-20,20-40,40-60,60-80,80-100"
| makemv cpu_range delim=","
| mvexpand cpu_range
| eval Number=0]
| dedup cpu_range
| sort cpu_range
| transpose header_field=cpu_range
| search column!="_*"
| rename column as cpu_range
Following is the code for Simple XML Chart configuration which applies Green, Blue, Yellow, Orange and Red colors as per the ranges from 0-20, 20-40, 40-60, 60-80 and 80-100 respectively.
<option name="charting.fieldColors">{"0-20":0x49B849,"20-40":0x006EAA,"40-60":0xE0AC16,"60-80":0xDA742E,"80-100":0xC84535}</option>
Please try out and confirm!
@jip31 refer to one of my older answers to invert the series using transpose
command: https://answers.splunk.com/answers/548161/how-to-change-colour-of-graphs.html
Following is the query as per your use case. Once you have 5 columns as per CPU ranges defined, you can use charting.fieldColors
Simple XML Chart configuration option to have the ranges colored as per your needs.
| makeresults count=30
| fields - _time
| eval host="host", counter=1
| accum counter
| eval counter=printf("%02d",counter),host=host.counter
| fields - counter
| eval process_cpu_used_percent=random(), process_cpu_used_percent=substr(process_cpu_used_percent,1,2)
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "Number" by cpu_range
| append
[| makeresults
| fields - _time
| eval cpu_range="0-20,20-40,40-60,60-80,80-100"
| makemv cpu_range delim=","
| mvexpand cpu_range
| eval Number=0]
| dedup cpu_range
| sort cpu_range
| transpose header_field=cpu_range
| search column!="_*"
| rename column as cpu_range
Following is the code for Simple XML Chart configuration which applies Green, Blue, Yellow, Orange and Red colors as per the ranges from 0-20, 20-40, 40-60, 60-80 and 80-100 respectively.
<option name="charting.fieldColors">{"0-20":0x49B849,"20-40":0x006EAA,"40-60":0xE0AC16,"60-80":0xDA742E,"80-100":0xC84535}</option>
Please try out and confirm!
perfect thanks
| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-1h@m"), relative_time(_time,"@m"))
| makecontinuous span=1m _time
| eval host="host".random()
| eval process_cpu_used_percent=random() % 100
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| chart dc(host) as "range" by cpu_range
| transpose 0 header_field=cpu_range
| eval column="cpu_range"
try bar chart.