All Apps and Add-ons

Clustered Single Value Map Visualisation - Change Marker Colours

alylanchester
Explorer

I'm trying to change the colour of my markers on my map. I have this within the query:

> eval redCount = if(TOTAL >=
> 10,TOTAL,0) | eval yellowCount =
> if((TOTAL >= 1 AND TOTAL <
> 10),TOTAL,0) | eval greenCount =
> if(TOTAL < 1,TOTAL,0) |

And then I'm adding this into the XML

<option name="mapping.fieldColors">{greenCount:0x6dc066,yellowCount:0xffd700,redCount:0xe60026}</option>

I'm basically following the steps detailed here: https://answers.splunk.com/answers/221348/geostats-display-bubbles-on-map-instead-of-pie-cha.html

Problem is that the markers remain green even though my stats value is > 10 (so should display red).

Any thoughts?

Here's the whole of the query:

index=A sourcetype=B | eval WARNFORTHISERROR=if(MESSAGETYPE=1,0,1) | append [search sourcetype=C index=2196161_23*_scada Type=Error | eval WARNFORTHISERROR=if(Type=Error,0,1)] | search WARNFORTHISERROR=1 |  lookup LOOKUP.csv index OUTPUT latitude longitude | rename latitude as lat longitude as lon | geostats count as TOTAL | eval redCount = if(TOTAL >= 10,TOTAL,0) | eval yellowCount = if((TOTAL >= 1 AND TOTAL < 10),TOTAL,0) | eval greenCount = if(TOTAL < 1,TOTAL,0) |

TIA

0 Karma
1 Solution

alylanchester
Explorer

I worked it out myself!

The greenCount, yellowCount and redCount seem pointless as actually there are parameters in the XML that need changing:

<option name="leaflet_maps_app.leaflet_maps.criticalThreshold">2</option>

<option name="leaflet_maps_app.leaflet_maps.warningThreshold">1</option>

View solution in original post

alylanchester
Explorer

I worked it out myself!

The greenCount, yellowCount and redCount seem pointless as actually there are parameters in the XML that need changing:

<option name="leaflet_maps_app.leaflet_maps.criticalThreshold">2</option>

<option name="leaflet_maps_app.leaflet_maps.warningThreshold">1</option>

cmoinet
Engager

Can you show you entire XML ?

It doesn't work for me

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...