topic Re: Unable to color text in single value field in Dashboards & Visualizations

Unable to color text in single value field

Bleepie — Wed, 01 Dec 2021 14:39:53 GMT

Dear Splunk Community,

I have the following code:

If count returns 0 events, I expect the color of the single value field to be red (severe), otherwise it should be green (low). But using the above code, there is no color at all (besides the default color black and white).

Why is the above not working?

Thanks in advance.

Re: Unable to color text in single value field

ITWhisperer — Wed, 01 Dec 2021 15:14:38 GMT

Try adding these options

<option name="colorBy">value</option> <option name="rangeColors">["0x53a051","0xdc4e41"]</option>

Re: Unable to color text in single value field

Bleepie — Thu, 02 Dec 2021 08:39:59 GMT

Unfortunately it doesn't apply:

Code:

<dashboard> <label></label> <row> <panel> <single> <search> <query>host="DESKTOP-L4ID3T2" source="BatchProcessor*" inventoryimport* "ExitCode: 0" | stats count | eval msg=case(count == 0, "Scan niet succesvol!", count > 0, "Scan succesvol!") | eval range=case(count == 0, "severe", count > 0, "low") | table msg</query> <earliest>0</earliest> <latest></latest> </search> <option name="field">range</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="colorBy">value</option> <option name="rangeColors">["0x53a051","0xdc4e41"]</option> </single> </panel> </row> <row> <panel> <single> <search> <query>host="DESKTOP-L4ID3T2" source="BatchProcessor*" inventoryimport* "ExitCode: 0" | stats count | eval msg=case(count == 0, "Scan niet succesvol!", count > 0, "Scan succesvol!") | eval range=case(count == 0, "severe", count > 0, "low") | table msg</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="field">range</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="colorBy">value</option> <option name="rangeColors">["0x53a051","0xdc4e41"]</option> </single> </panel> </row> </dashboard>

Re: Unable to color text in single value field

Bleepie — Mon, 06 Dec 2021 08:57:41 GMT

@ITWhisperer Hello Sensei, could you take another look at this 🙏?

Re: Unable to color text in single value field

ITWhisperer — Mon, 06 Dec 2021 09:22:27 GMT

You need to include range as an output field (single will only display values from the first field but can use other fields for the colouring)

| table msg range

Re: Unable to color text in single value field

Bleepie — Mon, 06 Dec 2021 09:39:49 GMT

I have applied range ( | table msg range) and even though the coloring works, the text is either severe (red) or low (green) where I would expect Scan not succesful (red) / Scan succesful (green). Any thoughts?

Re: Unable to color text in single value field

ITWhisperer — Mon, 06 Dec 2021 09:46:08 GMT

Single is using the first two fields so put count as the first

| table count msg range

Re: Unable to color text in single value field

Bleepie — Mon, 06 Dec 2021 09:50:21 GMT

This is the result

Re: Unable to color text in single value field

ITWhisperer — Mon, 06 Dec 2021 10:06:00 GMT

Go back to

| table msg range

and remove this line

<option name="field">range</option>

Re: Unable to color text in single value field

Bleepie — Mon, 06 Dec 2021 10:12:21 GMT

Works! Thanks