topic Re: How to color the field greater than or lower than or between? in Splunk Search

How to color the field greater than or lower than or between?

jip31 — Thu, 06 Feb 2020 13:45:24 GMT

Im a report, I am doing a basic count on a field

| stats values(CycleCount00) as "Cycle count" by host

when "Cycle count" result is > 300, I need to color the field in red
when "Cycle count" result is between 200 and 300, I need to color the field in orange
when "Cycle count" result is < 200, I need to color the field in green

what is the better way to do this?
I have also tried this it doesnt let me to user greater or lower than...

       <format type="color" field="Cycle count">
          <colorPalette type="minMidMax" maxColor="#31A35F" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>

Ithought about the rangemap command but I dont succeed to use it
is anybody cant help me please?

Re: How to color the field greater than or lower than or between?

nickhills — Thu, 06 Feb 2020 15:32:28 GMT

You should be able to use rangemap for this.

Try:

...| stats values(CycleCount00) as "Cycle count" by host|rangemap field="Cycle count" low=0-200 elevated=201-300 default=severe

In your table, add:

<option name="classField">range</option>

Re: How to color the field greater than or lower than or between?

jip31 — Fri, 07 Feb 2020 05:30:45 GMT

when I add the option name range I have a issue :
Unknown option name="classField" for node="table"

Re: How to color the field greater than or lower than or between?

to4kawa — Fri, 07 Feb 2020 06:29:22 GMT

<dashboard>
  <label>table sample</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=3
| streamstats count
| eval "Cycle count" = random() % 300 ,host="host_".count
| table host "Cycle count"</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <format type="color" field="Cycle count">
          <colorPalette type="list">[#53A051,#F1813F,#DC4E41]</colorPalette>
          <scale type="threshold">200,300</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

rangemap is not need.

Re: How to color the field greater than or lower than or between?

jip31 — Fri, 07 Feb 2020 06:49:59 GMT

perfect thanks