All Apps and Add-ons

Clustered Single Value Map Visualisation - Change Marker Colours

alylanchester
Explorer

I'm trying to change the colour of my markers on my map. I have this within the query:

> eval redCount = if(TOTAL >=
> 10,TOTAL,0) | eval yellowCount =
> if((TOTAL >= 1 AND TOTAL <
> 10),TOTAL,0) | eval greenCount =
> if(TOTAL < 1,TOTAL,0) |

And then I'm adding this into the XML

<option name="mapping.fieldColors">{greenCount:0x6dc066,yellowCount:0xffd700,redCount:0xe60026}</option>

I'm basically following the steps detailed here: https://answers.splunk.com/answers/221348/geostats-display-bubbles-on-map-instead-of-pie-cha.html

Problem is that the markers remain green even though my stats value is > 10 (so should display red).

Any thoughts?

Here's the whole of the query:

index=A sourcetype=B | eval WARNFORTHISERROR=if(MESSAGETYPE=1,0,1) | append [search sourcetype=C index=2196161_23*_scada Type=Error | eval WARNFORTHISERROR=if(Type=Error,0,1)] | search WARNFORTHISERROR=1 |  lookup LOOKUP.csv index OUTPUT latitude longitude | rename latitude as lat longitude as lon | geostats count as TOTAL | eval redCount = if(TOTAL >= 10,TOTAL,0) | eval yellowCount = if((TOTAL >= 1 AND TOTAL < 10),TOTAL,0) | eval greenCount = if(TOTAL < 1,TOTAL,0) |

TIA

0 Karma
1 Solution

alylanchester
Explorer

I worked it out myself!

The greenCount, yellowCount and redCount seem pointless as actually there are parameters in the XML that need changing:

<option name="leaflet_maps_app.leaflet_maps.criticalThreshold">2</option>

<option name="leaflet_maps_app.leaflet_maps.warningThreshold">1</option>

View solution in original post

alylanchester
Explorer

I worked it out myself!

The greenCount, yellowCount and redCount seem pointless as actually there are parameters in the XML that need changing:

<option name="leaflet_maps_app.leaflet_maps.criticalThreshold">2</option>

<option name="leaflet_maps_app.leaflet_maps.warningThreshold">1</option>

cmoinet
Engager

Can you show you entire XML ?

It doesn't work for me

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...