topic Re: Dashboard Background Color Formatting Based on Text in Dashboards & Visualizations

Dashboard Background Color Formatting Based on Text

jtoy1986 — Wed, 03 Nov 2021 15:02:16 GMT

I would like the background to be either Red or Green based on the text of "deviceSeverity." The value of deviceSeverity can either be "Up" or "Down." No matter what I do, the background is staying grey. I am new to Splunk formatting and tried searching through these various messages here, but have not had any luck.

This is the latest that I have and am probably over-complicating things (just want background to be red if deviceSeverity is "Down" and background to be green if deviceSeverity is "Up"):

<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="VIP Health Check Status" deviceSeverity=* | stats latest(deviceSeverity) | eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query> <earliest>-24h@h</earliest> <latest>now</latest> <refresh>30s</refresh> <refreshType>delay</refreshType> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="classField">deviceSeverity</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> <option name="charting.fieldColors"> {"severe": 0xFF0000, "low": 0x00FF00, "NULL":0xC4C4C0} </option>

Re: Dashboard Background Color Formatting Based on Text

PradReddy — Thu, 04 Nov 2021 22:34:53 GMT

Hi jtoy1986,

If visualization is a Statistics Table then you can define rules for coloring as below

XML:

<table>
<search>
<query>| makeresults 
| eval deviceSeverity = "Up" 
| append 
[| makeresults 
| eval deviceSeverity = "Down" ] 
| stats latest(deviceSeverity) 
| eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="latest(deviceSeverity)">
<colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette>
</format>
</table>

------

An upvote would be appreciated and Accept Solution if it helps!

Re: Dashboard Background Color Formatting Based on Text

jtoy1986 — Fri, 05 Nov 2021 01:23:20 GMT

I'm getting some validation errors. What am I doing wrong? Some say unknown option name for node "single." And node "Format" is not allowed here. Also getting the following after saving, so assuming query is wrong: "Error in 'makeresults' command: This command must be the first command of a search."

<panel> <title>VIP Health Check Status</title> <single> <title>Host: Components</title> <search> <query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="VIP Health Check Status" deviceSeverity=* | stats latest(deviceSeverity) | makeresults | eval deviceSeverity = "Up" | append [| makeresults | eval deviceSeverity = "Down" ] | stats latest(deviceSeverity) | eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe") </query> <earliest>-24h@h</earliest> <latest>now</latest> <refresh>30s</refresh> <refreshType>delay</refreshType> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="latest(deviceSeverity)"> <colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette> </format> </single> </panel>

Re: Dashboard Background Color Formatting Based on Text

jtoy1986 — Fri, 05 Nov 2021 01:56:32 GMT

I'm also hoping to do the same on some other ones. Basically want to show green or red based on the text that comes back in the query. For example, I am monitoring services and the panel will show "Running" or "Stopped."

deviceSeverity will show either "Running" or "Stopped" below in this case. In my original example, it is "Up" or "Down."

<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="Cyber-Ark Privileged Session Manager" deviceSeverity=*
| stats latest(deviceSeverity)</query>

Re: Dashboard Background Color Formatting Based on Text

jtoy1986 — Mon, 08 Nov 2021 12:44:35 GMT

Anyone else able to provide some insight on where I'm going wrong with my query? I'd love to do this in other dashboards where I can just show red or green based on text.