topic single value not changing colour in Dashboards & Visualizations

single value not changing colour

kris99 — Wed, 24 Sep 2014 06:54:54 GMT

following not displaying colour within the form.

If search finds events between 3012 - 3054, display Warning in Yellow (i.e elevated).

If I search and view as elevated, its displays the count of events in Yellow. But this is not working in form.

HV-test

<single>
  <title>HV Err</title>
  <searchString>index =xxx  Type!=Information  (EventCode&gt;="3012" AND EventCode&lt;="3054") | stats count | appendpipe [ stats count | eval Status="No Errors" | where count==0 ] | eval Status=if(count==0,"No Errors","Warning") | eval range = if(Status=="No Errors","low","elevated")</searchString>
  <earliestTime>-7d@h</earliestTime>
  <latestTime>now</latestTime>
  <option name="list.wrap">1</option>
  <option name="classField">range</option>
  <option name="field">Status</option>
</single>

Re: single value not changing colour

martin_mueller — Wed, 24 Sep 2014 09:16:22 GMT

Taking that panel XML works for me, the text is displayed as green if the count is zero and yellow otherwise.

Are there any CSS messages logged in your browser's console?
Does the app of that dashboard contain any CSS customization?

Re: single value not changing colour

stephanefotso — Fri, 19 Dec 2014 15:03:52 GMT

It should work. I made a code similar to yours, with forms inputs, and that works very well. Take a look at it.

<form>
  <label>single_value_changing_color</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="action" searchWhenChanged="true">
      <label>Choose one action</label>
      <choice value="*">All</choice>
      <populatingSearch fieldForLabel="action" fieldForValue="action">index=_audit|stats count by action|sort action</populatingSearch>
      <default>change_own_password</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>HV Err</title>
        <searchString>index=_audit action=$action$ | stats count by   user | appendpipe [stats sum(count) as count  | eval Status = "LESS THANT 20"|where count&lt;20]|sort action| eval Status=if(count&lt;20,"LESS THANT 20","MORE THAN 20") | eval range = if(Status=="LESS THANT 20","low","elevated")</searchString>
        <earliestTime>$time.earliest$</earliestTime>
        <latestTime>$time.latest$</latestTime>
        <option name="list.wrap">1</option>
        <option name="classField">range</option>
        <option name="field">Status</option>
        <option name="linkView">search</option>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>

Re: single value not changing colour

paulmarticsi — Sat, 21 Oct 2017 21:16:42 GMT

Get the Status Indicator app - it will allow you to do single value text with colors and icons. There are examples in the Dashboard Examples app by Splunk.
,A better way to go is to get the 'Status Indicator' app. Think of it as a super-powered single value visualization. I did the same thing with it and it includes the capacity to add an icon based on output.