All Apps and Add-ons

Clustered Single Value Map Visualisation - Change Marker Colours

alylanchester
Explorer

I'm trying to change the colour of my markers on my map. I have this within the query:

> eval redCount = if(TOTAL >=
> 10,TOTAL,0) | eval yellowCount =
> if((TOTAL >= 1 AND TOTAL <
> 10),TOTAL,0) | eval greenCount =
> if(TOTAL < 1,TOTAL,0) |

And then I'm adding this into the XML

<option name="mapping.fieldColors">{greenCount:0x6dc066,yellowCount:0xffd700,redCount:0xe60026}</option>

I'm basically following the steps detailed here: https://answers.splunk.com/answers/221348/geostats-display-bubbles-on-map-instead-of-pie-cha.html

Problem is that the markers remain green even though my stats value is > 10 (so should display red).

Any thoughts?

Here's the whole of the query:

index=A sourcetype=B | eval WARNFORTHISERROR=if(MESSAGETYPE=1,0,1) | append [search sourcetype=C index=2196161_23*_scada Type=Error | eval WARNFORTHISERROR=if(Type=Error,0,1)] | search WARNFORTHISERROR=1 |  lookup LOOKUP.csv index OUTPUT latitude longitude | rename latitude as lat longitude as lon | geostats count as TOTAL | eval redCount = if(TOTAL >= 10,TOTAL,0) | eval yellowCount = if((TOTAL >= 1 AND TOTAL < 10),TOTAL,0) | eval greenCount = if(TOTAL < 1,TOTAL,0) |

TIA

0 Karma
1 Solution

alylanchester
Explorer

I worked it out myself!

The greenCount, yellowCount and redCount seem pointless as actually there are parameters in the XML that need changing:

<option name="leaflet_maps_app.leaflet_maps.criticalThreshold">2</option>

<option name="leaflet_maps_app.leaflet_maps.warningThreshold">1</option>

View solution in original post

alylanchester
Explorer

I worked it out myself!

The greenCount, yellowCount and redCount seem pointless as actually there are parameters in the XML that need changing:

<option name="leaflet_maps_app.leaflet_maps.criticalThreshold">2</option>

<option name="leaflet_maps_app.leaflet_maps.warningThreshold">1</option>

cmoinet
Engager

Can you show you entire XML ?

It doesn't work for me

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...