topic Re: How to change color of a Panel based on String in Splunk Search

How to change color of a Panel based on String?

devsru — Thu, 03 Aug 2023 21:04:24 GMT

Hi All,I am running a dashboard which returns the total count(stats count) of field mentioning Severity=ok or Severity=Critical.

The requirement is if atealst one field value is Severity=Critical, the color of the panel should turn to Red otherwise Green when Severity=Ok.

Can someone please suggest.

Re: How to change color of a Panel based on String

ITWhisperer — Thu, 03 Aug 2023 13:07:20 GMT

You could use CSS to change the colour of the panel using a token which is set based on the results of the search.

Re: How to change color of a Panel based on String

devsru — Thu, 03 Aug 2023 13:13:00 GMT

@ITWhisperer

How to achieve this ?

My query is index =* Severity=* | stats count

Here Severity can be either "CRITICAL" or "OK"

I want to display red if the Severity is "CRITICAL" or "OK" . (It can be 100 events OK and 50 as CRITICAL.) If all are OK then display GREEN

Re: How to change color of a Panel based on String

ITWhisperer — Thu, 03 Aug 2023 13:38:23 GMT

Start with this

index =* Severity=* | stats count(eval(Severity=="CRITICAL")) as Critical count(eval(Severity=="OK")) as OK | eval colour=if(insnotnull(Critical) and Critical > 0, "red", "green")

Then in your done handler, set a token to $result.colour$ and use this token in your CSS.

Re: How to change color of a Panel based on String

devsru — Thu, 03 Aug 2023 14:45:09 GMT

Hi @ITWhisperer Apologies but I don't know using CSS. Will it be possible to provide me the XML.

For example I want to highlight the server vmp-stata-01 as Red as it has one "critical" Severity field and 8 "OK"

Re: How to change color of a Panel based on String

ITWhisperer — Thu, 03 Aug 2023 15:14:10 GMT

Please share your dashboard source for this panel in a codeblock

Re: How to change color of a Panel based on String

devsru — Thu, 03 Aug 2023 17:09:12 GMT

<dashboard version="1.1" theme="dark"> <search id="base_search"> <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y) [ search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m | stats latest(_time) as time latest(severity) as severity by entity_name kpi | eval host=lower(mvindex(split(entity_name, "."), 0)) | table host kpi severity time ] | eval severity=coalesce(severity, 2), n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S") | fields - n _key _timediff | sort - severity host kpi | eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") | fields host kpi severity | rename host as Host, kpi as KPI, severity as Severity </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <label>Application Dashboard</label> <row> <panel> <title>PRD</title> <single> <title>Server Name</title> <search base="base_search"> <query>| search Host=xyz* Severity=* | stats count</query> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0x53a051"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </dashboard>

Re: How to change color of a Panel based on String

devsru — Thu, 03 Aug 2023 17:09:46 GMT

@ITWhisperer Appreciate your help on this one.

Re: How to change color of a Panel based on String

ITWhisperer — Fri, 04 Aug 2023 08:00:01 GMT

Try something like this

<dashboard version="1.1" theme="dark"> <search id="base_search"> <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y) [ search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m | stats latest(_time) as time latest(severity) as severity by entity_name kpi | eval host=lower(mvindex(split(entity_name, "."), 0)) | table host kpi severity time ] | eval severity=coalesce(severity, 2), n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S") | fields - n _key _timediff | sort - severity host kpi | eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") | fields host kpi severity | rename host as Host, kpi as KPI, severity as Severity </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <label>Application Dashboard</label> <row> <panel> <title>PRD</title> <single> <title>Server Name</title> <search base="base_search"> <query>| search Host=xyz* Severity=* | eval range=if(Severity=="CRITICAL",6,0) | fields Host KPI range</query> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0xff0000"]</option> <option name="rangeValues">[6]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </dashboard>

Re: How to change color of a Panel based on String

devsru — Fri, 04 Aug 2023 10:02:57 GMT

Hi @ITWhisperer I tried but this Sub query but it won't work because I have more than 100 KPI's. Here I am interested only in the count and turn Red/Green if any one of the Severity is triggered.

  <query>| search Host=xyz* Severity=*
| eval range=if(Severity=="CRITICAL",6,0) 
| fields Host KPI range</query>

Re: How to change color of a Panel based on String

ITWhisperer — Fri, 04 Aug 2023 11:26:44 GMT

OK Try this

<dashboard version="1.1" theme="dark"> <search id="base_search"> <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y) [ search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m | stats latest(_time) as time latest(severity) as severity by entity_name kpi | eval host=lower(mvindex(split(entity_name, "."), 0)) | table host kpi severity time ] | eval severity=coalesce(severity, 2), n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S") | fields - n _key _timediff | sort - severity host kpi | eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") | fields host kpi severity | rename host as Host, kpi as KPI, severity as Severity </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <label>Application Dashboard</label> <row> <panel depends="$alwaysHide$"> <html> <style> #single_prd text { fill: $single_text_colour$ !important; } </style> </html> </panel> <panel> <title>PRD</title> <single id="single_prd"> <title>Server Name</title> <search base="base_search"> <query>| search Host=xyz* Severity=* | stats count count(eval(Severity=="CRITICAL")) as _critical | eval _colour=if(_critical>0,"red","green")</query> <done> <set token="single_text_colour">$result._colour$</set> </done> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </dashboard>

Re: How to change color of a Panel based on String

devsru — Wed, 09 Aug 2023 06:35:38 GMT

Hi @ITWhisperer Wonderful. The solution seems to be working. I have a small modification in requirement.

If the Severity is "Critical" then it should display Red, If "OK" then green , if "Amber" then yellow.

Can you please help me with that.

Re: How to change color of a Panel based on String

ITWhisperer — Wed, 09 Aug 2023 06:41:57 GMT

It depends on what your criteria for AMBER is - if I assume it is "MEDIUM" and that if the count for critical is zero but the count for MEDIUM is not zero, then this is AMBER? - you could change the query to this

<query>| search Host=xyz* Severity=* | stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="MEDIUM")) as _amber | eval _colour=if(_critical>0,"red",if(_amber>0,"yellow","green"))</query>

Re: How to change color of a Panel based on String

devsru — Wed, 09 Aug 2023 07:46:47 GMT

@ITWhisperer

The requirement is if we have atleast one Severity count as "CRITICAL" change the color to Red. No matter if we have "MEDIUM" or "OK" events.

If "MEDIUM" and "OK" but no "CRITICAL" then AMBER

if "OK" only then green

Re: How to change color of a Panel based on String

devsru — Wed, 09 Aug 2023 13:36:09 GMT

@ITWhisperer Can you tell me the correct quere based on the case mentioned in my previous reply.

| stats count count(eval(Severity=="CRITICAL")) as _critical
| eval _colour=if(_critical>0,"red","green")</query>

Re: How to change color of a Panel based on String

ITWhisperer — Wed, 09 Aug 2023 13:59:07 GMT

See my previous response

Re: How to change color of a Panel based on String

devsru — Wed, 09 Aug 2023 14:00:28 GMT

@ITWhisperer

I managed to do this with below query. Thanks for all your help

| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red","green",_critical=0 AND _medium>0,"yellow","green",_critical=0 AND _medium=0,"green","red")

Re: How to change color of a Panel based on String

ITWhisperer — Wed, 09 Aug 2023 14:12:50 GMT

It looks like your case function is not set up correctly, although this could just be a copy/paste error?

Re: How to change color of a Panel based on String

devsru — Wed, 09 Aug 2023 14:17:54 GMT

@ITWhisperer

Indeed it was a typo 🙂

| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green")

Re: How to change color of a Panel based on String

ITWhisperer — Wed, 09 Aug 2023 14:20:43 GMT

OK now your logic seems a little unrobust. What happens if _critical > 0 and _medium = 0?