topic Using eval to change text color in single value module. in Splunk Search

Using eval to change text color in single value module.

donfarland — Mon, 08 Jun 2015 14:29:05 GMT

I am trying to create a single value visualization where the text changes colors based on its value. The criteria for the ranges and colors are:
- 0-67 = Severe
- 67-69 = Warning
- 69-85 = OK
- 85-87 = Warning
- 87-100 = Severe
I tried to use the rangemap function, but discovered that I couldn't use the default "severe", "elevated" color coding if I had two independent ranges for severe and warning. I've managed to confirm that the following search string works, but the color coding is not working. I think the issue is with the fieldColors option, but I'm not sure what I'm missing.

      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>index="pmf_therms" host=5800-106-ADP | stats latest(S1_Temp) as reading | eval okReading=if(reading>75 AND reading<85,reading,0) | eval sevReading=if(reading<67 OR reading>87,reading,0) | eval warnReading=if((reading>67 AND reading<75) OR (reading>85 AND reading<87) ,reading,0)</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,67,"70","84",87,100]</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xebe42d,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
        <option name="afterLabel">°F</option>
        <option name="charting.fieldColors">{"sevReading":0xFF0000,"warnReading":0xFFFF00}</option>
      </single>

Re: Using eval to change text color in single value module.

MuS — Wed, 10 Jun 2015 23:33:43 GMT

Hi donfarland,

take and this run everywhere example to display a color changing single value:

<form>
  <label>rangemap</label>
  <fieldset submitButton="true">
    <input type="text" token="field1" searchWhenChanged="true"></input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>| stats count | eval reading=$field1$ | eval ok_level=if(reading>75 AND reading<85,"low",null()) | eval sev_level=if(reading<67 OR reading>87,"severe",null()) | eval warn_level=if((reading>67 AND reading<75) OR (reading>85 AND reading<87),"elevated",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | table reading level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="linkView">search</option>
        <option name="charting.chart.rangeValues">[0,30,40,60,70,100]</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xFFE800,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="drilldown">none</option>
        <option name="afterLabel">°F</option>
        <option name="classField">level</option>
        <option name="field">reading</option>
      </single>
    </panel>
  </row>
</form>

I used a second field level to set the severity, just adapt it to your needs.
The rangemap command is redundant here, because you're expressly setting the option classField and a couple of classes are available out of the box like "low", (green), "elevated" (amber), and "severe" (red).

Hope this helps to get you to your target ...

cheers, MuS