topic Re: choose color based on text value in Splunk Search

How to choose color based on text value?

smanojkumar — Fri, 31 Mar 2023 16:29:44 GMT

Hi there!

I need to choose the color in the dashboard based on the text results in dashboard,

where the value is "OK", it should be in green color,

where the value is "Ko", it should be in red color,

this is the only field that the dashboard returns.

Thanks in Advance!

Re: choose color based on text value

ITWhisperer — Fri, 31 Mar 2023 10:18:05 GMT

Re: choose color based on text value

smanojkumar — Mon, 03 Apr 2023 06:11:00 GMT

Hi @ITWhisperer ,

Is this code being same for single value visualization?
I can see it works fine for table, but I need it for Single value visualization,

Thanks!

Re: choose color based on text value

ITWhisperer — Mon, 03 Apr 2023 07:16:14 GMT

You are right, this doesn't work for single visualisations. Instead you could ddd an extra field to your query called range.

| eval range=if(value=="OK","low","severe")

Re: choose color based on text value

smanojkumar — Fri, 07 Apr 2023 09:36:24 GMT

Hi @ITWhisperer ,

Can you please help me here, where i need to make change, i just made in query, i'm having some error

<form theme="dark"> <label> ASSET STATUS</label> <fieldset submitButton="false" autoRun="true"> <input type="radio" token="category" searchWhenChanged="true"> <label>Category</label> <choice value="work">Work</choice> <choice value="auto">Auto</choice> <choice value="server">Server</choice> <search> <query/> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>work</default> <change> <condition value="work"> <set token="Work">"Work"</set> <unset token="Auto"></unset> </condition> <condition value="auto"> <set token="Auto">"Auto"</set> <unset token="Work"></unset> </condition> <condition value="server"> <set token="Server">"Server"</set> <unset token="Work"></unset> <unset token="Auto"></unset> </condition> </change> </input> <input type="text" token="src_name" searchWhenChanged="true"> <label>src_name</label> <default>*</default> </input> </fieldset> <row> <panel> <title>SOC CHECK</title> <single> <search> <query>| inputlookup $category$_sanity_check_kvstore | fields src_name, soc_check | search src_name IN ($src_name$) | eval soc_check=if(soc_check=1,"OK","KO") | eval range=if(value=="OK","low","severe") | table soc_check</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0xdc4e41","0x53a051"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> </row>

Re: choose color based on text value

ITWhisperer — Fri, 07 Apr 2023 09:12:47 GMT

What has this to do with your original question?

Re: choose color based on text value

smanojkumar — Fri, 07 Apr 2023 09:22:22 GMT

In the above query, I added eval range command, since i didn't get the expected one,

Same, If the soc_check is "OK", the result should be in green colour, if the soc_check is "KO", the result should be in red colour

Re: choose color based on text value

smanojkumar — Mon, 10 Apr 2023 11:20:47 GMT

Hi @ITWhisperer ,

If the soc_check is "OK", the result should be in green color, if the soc_check is "KO", the result should be in red color, with the above query

Re: choose color based on text value

ITWhisperer — Mon, 10 Apr 2023 11:26:17 GMT

Given that you didn't originally give much information, I would have expected you to adapt any solution given to your specific circumstances.

Try changing

| eval range=if(value=="OK","low","severe")

| eval range=if(soc_check=="OK","low","severe")

since this is the field you appear to be using

Re: choose color based on text value

smanojkumar — Mon, 10 Apr 2023 11:32:35 GMT

Hi @ITWhisperer

The query is working but the color is still not changed.

Thanks!

Re: choose color based on text value

smanojkumar — Wed, 12 Apr 2023 06:17:48 GMT

Hi @ITWhisperer

Can you help me in this?

Re: choose color based on text value

Manasa_401 — Wed, 12 Apr 2023 08:23:49 GMT

Hello @smanojkumar

Are you fetching the range field in table output fields?
If not, give both soc_check and range fields in table command.

If this helps, karma would be appreciated.

Thanks,

Manasa

Re: choose color based on text value

smanojkumar — Wed, 12 Apr 2023 08:31:50 GMT

Hi @Manasa_401

Even after adding range field in table command, i cant see the color change,

My requirement is to check the soc_check field value color based on its values

OK- green

KO-Red

Re: choose color based on text value

Manasa_401 — Wed, 12 Apr 2023 09:27:41 GMT

Try again by disabling the usecolors option

Re: choose color based on text value

smanojkumar — Wed, 12 Apr 2023 10:24:11 GMT

Hi @Manasa_401

Still, I didn't get the expected after removing the command.