https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239656#M14858 <P>Arggg, so the field has to be the value and then a table command is needed. Thanks for the help, somesoni2 this got things working.</P> Thu, 07 Jul 2016 18:56:36 GMT splunker1981 2016-07-07T18:56:36Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239654#M14856 <P>Hello Splunkers,</P> <P>Hoping someone can help or point me in the right direction. I am trying to color code my single value string based on value ranges they fall under. Here is my XML. What I am trying to do is make the string RUNNING green and DOWN red. What am I missing here? I'm on version 6.4. Thanks for all the help in advance.</P> <PRE><CODE> &lt;query&gt;|stats count| fields - count | eval diff=2000| eval status=case(diff&lt;=1500, "RUNNING", diff &gt;1501, "DOWN") |rangemap field=status low=0-1500 severe=1501-9999&lt;/query&gt; &lt;earliest&gt;0&lt;/earliest&gt; &lt;latest&gt;&lt;/latest&gt; &lt;/search&gt; &lt;option name="classField"&gt;range&lt;/option&gt; &lt;option name="field"&gt;status&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="colorBy"&gt;value&lt;/option&gt; &lt;option name="colorMode"&gt;none&lt;/option&gt; &lt;option name="numberPrecision"&gt;0&lt;/option&gt; &lt;option name="rangeColors"&gt;["0x65a637","0x555555"]&lt;/option&gt; &lt;option name="showSparkline"&gt;1&lt;/option&gt; &lt;option name="showTrendIndicator"&gt;1&lt;/option&gt; &lt;option name="trendColorInterpretation"&gt;standard&lt;/option&gt; &lt;option name="trendDisplayMode"&gt;absolute&lt;/option&gt; &lt;option name="unitPosition"&gt;after&lt;/option&gt; &lt;option name="useColors"&gt;1&lt;/option&gt; &lt;option name="useThousandSeparators"&gt;1&lt;/option&gt; &lt;option name="linkView"&gt;search&lt;/option&gt; </CODE></PRE> Thu, 07 Jul 2016 16:59:42 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239654#M14856 splunker1981 2016-07-07T16:59:42Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239655#M14857 <P>Try this search</P> <PRE><CODE>|stats count| fields - count | eval diff=2000| eval status=case(diff&lt;=1500, "RUNNING", diff &gt;1501, "DOWN") |rangemap field=diff low=0-1500 severe=1501-9999 |table status range </CODE></PRE> Thu, 07 Jul 2016 18:19:31 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239655#M14857 somesoni2 2016-07-07T18:19:31Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239656#M14858 <P>Arggg, so the field has to be the value and then a table command is needed. Thanks for the help, somesoni2 this got things working.</P> Thu, 07 Jul 2016 18:56:36 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-edit-my-dashboard-XML-to-get-a-single-value-string-to/m-p/239656#M14858 splunker1981 2016-07-07T18:56:36Z