topic Re: How to modify my single value visualization? in Dashboards & Visualizations

How to modify my single value visualization?

weiquanswq — Tue, 04 Oct 2016 14:55:16 GMT

Hi !!
I am new to Splunk and trying to create a single value visualization with 2 values. ( ... | table first, second )
The "first" value determines the value to be displayed.
The "second" value determines the color.

Currently, I am able to display the "first" value but the color is affected by the "first" value.

Is there any suggestion?
Thanks in advance 🙂

Re: How to modify my single value visualization?

ChrisG — Tue, 04 Oct 2016 16:51:14 GMT

Coloring by value requires stats or timechart. See Customize a single value in the Dashboards and Visualizations manual for complete information.

Re: How to modify my single value visualization?

weiquanswq — Wed, 05 Oct 2016 01:44:45 GMT

ChrisG,

I have modified the search to as such

| table id, first, second | stats values(first) as firstVal values(second) as secondVal by id
But it is still affected by firstVal

Re: How to modify my single value visualization?

maciep — Wed, 05 Oct 2016 02:05:54 GMT

how are the first and second values related? I could be mistaken, but I thought the single value only worked with one value - so the coloring would have to be based on that value.

Re: How to modify my single value visualization?

sundareshr — Wed, 05 Oct 2016 03:44:47 GMT

Single value panel accepts/recognizes only one value. Color is based on this single value. Your options are either to color the value or color the trend based on the value for the same field but in the next event. You can set ranges (format) to determine the color, but the range is based on the value in the first (only) field.

Re: How to modify my single value visualization?

weiquanswq — Thu, 06 Oct 2016 01:20:30 GMT

Thanks sundareshr.

Re: How to modify my single value visualization?

aaraneta_splunk — Mon, 24 Oct 2016 02:59:38 GMT

Hi @weiquanswq - Did this answer provide the solution to your question? If yes, please don't forget to click "Accept" below this answer to resolve this post. Thanks!