topic Re: How to change a single panel color based on text result with unit format ? in Splunk Search

How to change a single panel color based on text result with unit format ?

jip31 — Fri, 31 Jul 2020 06:05:59 GMT

In the search below, I would be able to change the background color following the value of the FreeSpace field

It works if I delete the format of the field

| eval FreeSpace=FreeSpace." GB"

but I need to keep it in the search

How to do this please? Is anybody can help?

Re: How to change a single panel color based on text result?

kmugglet — Mon, 27 Jul 2020 06:10:56 GMT

Are you using the Single Value visualization for your panel?

If so , try removing the eval where you append the GB suffix.

Set the color range in the viz format settings, and add the GB as a suffix in the viz format settings.

Re: How to change a single panel color based on text result?

jip31 — Mon, 27 Jul 2020 06:08:45 GMT

yes I use it

but i dont want to add the GB suffix because if I am doing that I have an issue in the appendpipe command results :

"No event for this host GB" is displayed instead "No event for this host"

Re: How to change a single panel color based on text result?

kmugglet — Mon, 27 Jul 2020 06:23:51 GMT

Ah ok, I see what you mean 🙂
Try this - can't really test myself, but it should work.

Re: How to change a single panel color based on text result?

kmugglet — Mon, 27 Jul 2020 06:26:22 GMT

Oh wait , that doesn't actually solve your initial problem does it..........

Gimme 5 mins

Re: How to change a single panel color based on text result?

jip31 — Mon, 27 Jul 2020 06:30:36 GMT

No sorry same problem

Re: How to change a single panel color based on text result?

kmugglet — Mon, 27 Jul 2020 06:50:31 GMT

OK, 3rd time lucky

Re: How to change a single panel color based on text result?

jip31 — Mon, 27 Jul 2020 07:10:08 GMT

unfortunately no

"Error in rangemap command : invalid range"

Re: How to change a single panel color based on text result with unit format ?

renjith_nair — Sat, 08 Aug 2020 05:29:04 GMT

@jip31 ,

Try this run anywhere example and see it fits your use case

<form> <label>Single Value</label> <fieldset submitButton="false"> <input type="radio" token="data" searchWhenChanged="true"> <label>Data</label> <choice value="1">With Data</choice> <choice value="0">Without Data</choice> <initialValue>1</initialValue> <default>1</default> </input> </fieldset> <row> <panel> <single> <search> <done> <condition match="'result.dummy' =="false""> <set token="unit">GB</set> </condition> <condition> <set token="unit"></set> </condition> </done> <query>|makeresults |eval host="host1",FreeSpace=25|eval dummy="false"|where 1=$data$ |appendpipe [| stats count | eval FreeSpace="No event for this host" | where count = 0 | eval dummy="true" | table FreeSpace,dummy ] </query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0xdc4e41","0xf1813f","0xf8be34","0xdc4e41"]</option> <option name="rangeValues">[0,30,70]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">0</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unit">$unit$</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </form>

Re: How to change a single panel color based on text result with unit format ?

jip31 — Mon, 10 Aug 2020 05:28:54 GMT

yes thanks!