topic Re: Use of fillnull displays wrong color in 'single value' in Splunk Search

Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 05 Jun 2019 12:06:42 GMT

I am using | fillnull totalCount in my search so I get an 0 when there is no result.
The color range I use is from min to 0 is green, from 0 to max is red.
Somehow the '0' is still showing red. Is there any way to change this?

Re: Use of fillnull displays wrong color in 'single value'

adonio — Wed, 05 Jun 2019 12:51:57 GMT

do from min to 0 green and from 1 to max red

Re: Use of fillnull displays wrong color in 'single value'

VatsalJagani — Wed, 05 Jun 2019 12:57:20 GMT

Hi @Mike6960,

Use |filnull totalCount value=0. Also, make sure color configuration is saved properly to save the dashboard and refresh the browser page. Otherwise, the configuration (min-0 green and 0-max red) works for me. (I'm using Splunk version 7.2) Check XML would look like:

<option name="rangeColors">["0x53a051","0xdc4e41"]</option>
<option name="rangeValues">[0]</option>

Hope this helps!!!

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 05 Jun 2019 13:12:05 GMT

Hi @Mike6960,

Make sure you have something like this for your colors in xml :

<option name="rangeColors">["0x65a637","0xd93f3c"]</option>
<option name="rangeValues">[0.99]</option>

Also since this makes 0-0.99 green you can use 0.1 instead for fillnull if 0 is still not working : ...|fillnull value=0.1 totalCount or force to zero just in case : ...|fillnull value=0 totalCount

Cheers,
David

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 05 Jun 2019 14:07:30 GMT

No, that doesn't work either

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 05 Jun 2019 14:08:22 GMT

I have the same in my xml en tried your suggestions but it does not work

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 05 Jun 2019 14:08:34 GMT

tried your suggestions but it does not work

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 05 Jun 2019 14:13:31 GMT

could you please post the xml for your single value view ?

Re: Use of fillnull displays wrong color in 'single value'

VatsalJagani — Wed, 05 Jun 2019 14:14:49 GMT

From the UI edit dashboard and check XML. Also, give me which Splunk verion you are using.

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Thu, 06 Jun 2019 06:40:56 GMT

Version 7.0.0
value
block
all
0
["0x65a637","0xd93f3c"]
[1]
progressbar
1
1
0
1
medium
standard
absolute
Niet aangekomen Verint
after
1
1

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 19 Jun 2019 10:28:18 GMT

@DavidHourani , i got it working. I had the fillnull not at the end. But I have another search where te fillnull does not work at all. Maybe you see why?

index=captiva
|chart count by message.messageid
| search count < 2
|stats sum(count)
| fillnull count value=0

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 19 Jun 2019 10:32:05 GMT

hahah, well replace that one then with this :

index=captiva 
|chart count by message.messageid 
| search count < 2 
|stats sum(count)
| append [ | makeresults | eval count=0 | table count ] 
| head 1

if there are no values, sum will not give a null field, it will actually give nothing at all, so you need to create an extra fake field that will only show in case there are no results 🙂

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 19 Jun 2019 11:31:41 GMT

@DavidHourani Thanks, I get a 0 value now. I edited the xml like you suggested in your first answer and also this works great!. Thank You very much. I dont think i will ever accomplish using splunk without asking for help ....

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 19 Jun 2019 11:36:27 GMT

This should do the trick :

  <single>
        <search>
          <query>index=captiva 
| chart count by message.messageid 
| where count < 2 
| stats sum(count) 
| append 
    [| makeresults 
    | eval count=0 
    | table count ] 
| head 1
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
       <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 19 Jun 2019 11:39:49 GMT

fixed xml formatting you can try the above now.

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 19 Jun 2019 11:50:07 GMT

@DavidHourani , it worked already with your first suggestion. I only thought I needed to use fillenull but i understand that the append does the same trick?

My xml is now

<single>
        <title></title>
        <search>
          <query>index=captiva 
 |chart count by message.messageid 
 | search count &lt; 2 
 |stats sum(count)
 | append [ | makeresults | eval count=0 | table count ] 
 | head 1</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x65a637","0xd93f3c"]</option>
        <option name="rangeValues">[0.99]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">niet aangekomen in ESB</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 19 Jun 2019 11:53:34 GMT

yes, it does, fillnull will work when the column is already there and you want to fill null values whereas append will work when there are no columns and no results typically after you run a stats command such as sum or count and there is nothing to sum/count.

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 19 Jun 2019 12:20:13 GMT

@DavidHourani . I was to soon with my cheering...It still displays a red color when the value is 0.

Re: Use of fillnull displays wrong color in 'single value'

DavidHourani — Wed, 19 Jun 2019 12:25:14 GMT

try the xml I sent you above, should be green

Re: Use of fillnull displays wrong color in 'single value'

Mike6960 — Wed, 19 Jun 2019 12:58:51 GMT

I am going mad, its not working. This is the xml I have now:

<single>
                 <search>
           <query>index=captiva 
 | chart count by message.messageid 
 | where count &lt; 2
 | stats sum(count) 
 | append 
     [| makeresults 
     | eval count=0 
     | table count ] 
 | head 1
</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
         <option name="colorMode">block</option>
         <option name="drilldown">none</option>
         <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
         <option name="rangeValues">[0]</option>
         <option name="refresh.display">progressbar</option>
         <option name="showSparkline">1</option>
         <option name="showTrendIndicator">1</option>
         <option name="trellis.enabled">0</option>
         <option name="trellis.scales.shared">1</option>
         <option name="trellis.size">medium</option>
         <option name="trendColorInterpretation">standard</option>
         <option name="trendDisplayMode">absolute</option>
         <option name="unitPosition">after</option>
         <option name="useColors">1</option>
         <option name="useThousandSeparators">1</option>

      </single>