topic Re: help on rangemap in Splunk Enterprise

help to color a text in a single panel following conditions

jip31 — Fri, 14 Jan 2022 17:48:55 GMT

I need to color the field "sante" in red if his value is "Etat dégradé" and green if his value os "Etat stable"

| stats count(hang_process_name) AS hang | eval sante=if(hang>0, "Etat dégradé", "Etat stable") | table sante | rangemap field=sante low=0-0 default=severe

what is wrong please?

Re: help on rangemap

richgalloway — Fri, 14 Jan 2022 15:24:07 GMT

The rangemap command needs numeric values. This query should color the field as desired, but doesn't use the specified text.

| stats count(hang_process_name) AS hang | eval sante=if(hang>0, 1, 0) | table sante | rangemap field=sante low=0-0 default=severe

Re: help on rangemap

jip31 — Fri, 14 Jan 2022 15:55:24 GMT

sorry, but my needs is to color a text so in my eval command I confirm that I need

| eval sante=if(hang>0, "OK", "KO")

so rangemap is not the good way due to numeric fields?

Re: help on rangemap

richgalloway — Fri, 14 Jan 2022 18:08:13 GMT

Correct. If the field has to be text then rangemap is not the answer.

If this is part of a dashboard then this answer should help: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condition-for-a-particular/m-p/487257

Re: help on rangemap

jip31 — Sat, 15 Jan 2022 06:01:24 GMT

Thanks but I need to display the results in a single panel and not in a table

I have done it works fine

eval sante=if(hang>1,"KO","OK") | table sante | eval severity=if(sante="KO",1,0) | rangemap field=severity low=0-0 default=severe