All Apps and Add-ons

Color map not working on New Relic Splunk App

ShaneNewman
Motivator

In version 2.0.0 of the New Relic Splunk App (UI), the color mappings are not working in the Applications Overview table. This is a minor issue and does not prevent the app from being useful, it would just be nice to have it working as documented. There are no errors in splunkd.log about not being able to render the color mappings, which is making this difficult to troubleshoot.

This app is managed via the deployer in a 5 node SHC, all nodes are rendering without the color mappings. Is anyone else having this issue with the New Relic Splunk app? I have tested on Safari and Chrome, cleared cache, re-applied the bundle and performed a rolling-restart of the shcluster members.

XML for panel:


Application Overview - Last Reported Values

get_sources( "newrelic:applications","*", "applications.json","*")
| search new_source="$input_name$"
id="$web_app$"

| dedup name 
| eval account_id = mvindex(split(new_source,":"),1)

| rename id as application_id application_summary.* as app.* end_user_summary.* as eum.* 

| table account_id application_id name language reporting health_status app.apdex_score app.response_time app.throughput app.error_rate eum.apdex_score eum.response_time eum.throughput app.host_count app.instance_count last_reported_at 

| sort reporting desc, health_status desc</query>
          <earliest>$myTime.earliest$</earliest>
          <latest>$myTime.latest$</latest>
        </search>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="health_status">
          <colorPalette type="map">{"red":#D93F3C,"green":#65A637,"gray":#D3D3D3,"unknown":#555555,"orange":#ED8440}</colorPalette>
        </format>
        <format type="color" field="reporting">
          <colorPalette type="map">{"true":#65A637,"false":#D3D3D3}</colorPalette>
        </format>
        <format type="color" field="app.apdex_score">
          <colorPalette type="list">[#D93F3C,#F7BC38,#65A637]</colorPalette>
          <scale type="threshold">0.75,0.9</scale>
        </format>
        <format type="number" field="app.apdex_score"></format>
        <format type="number" field="app.throughput">
          <option name="unit">rpm</option>
        </format>
        <format type="number" field="eum.throughput">
          <option name="unit">rpm</option>
        </format>
        <format type="number" field="eum.apdex_score"></format>
        <format type="color" field="eum.apdex_score">
          <colorPalette type="list">[#D93F3C,#F7BC38,#65A637]</colorPalette>
          <scale type="threshold">0.75,0.9</scale>
        </format>
        <drilldown target="_blank">
          <link>https://rpm.newrelic.com/accounts/$row.account_id$/applications/$row.application_id$?tw[start]=$earliest$&amp;tw[end]=$latest$<!-- https://rpm.newrelic.com/accounts/$row.source$/applications/$row.application_id$?tw[start]=$earliest$&amp;tw[end]=$latest$  -->
          </link>
        </drilldown>
      </table>
    </panel>

Capture of the rendered cells that should be highlighted:
alt text

0 Karma
1 Solution

gpareesi11
Path Finder

gpareesi11
Path Finder

mattymo
Splunk Employee
Splunk Employee

Hi ShaneNewman! What Splunk version is the environment running?

0 Karma

ShaneNewman
Motivator

We are running Splunk 6.4.4

0 Karma

mattymo
Splunk Employee
Splunk Employee

in the latest version of 6.x Dash examples:
Likely only means there is some other way....still poking at 6.4.4 viz docs

alt text

Im thinking this:

http://docs.splunk.com/Documentation/Splunk/6.4.4/Viz/ChartConfigurationReference

charting.fieldColors    Map of hex colors.
See description.

—
The map of hexadecimal color values to use for each field.
A map is a comma-delimited list of key/value pairs, enclosed in curly braces.

Keys are separated from their values by a colon.

Example:

{"foo\: bar": 0xffff00, foo: 0xff0000, "foobar": 0x000000}

Escape the following special characters in a key or string value with double quotes:

[]{}(),:"
Escape existing double quotes or backslashes or colons with a preceding backslash.

See Specify custom colors for fields in charts for an example.
0 Karma

mattymo
Splunk Employee
Splunk Employee
<chart>
        <title>Field colors example</title>
        <search>
          <query>
            index = _internal log_level=* | stats
            count(eval(log_level="ERROR")) as ERROR
            count(eval(log_level="WARN")) as WARN
            count(eval(log_level="INFO")) as INFO
            by sourcetype
          </query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.fieldColors">
          {"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x0066FF, "NULL":0xC4C4C0}
        </option>
        <option name="charting.legend.placement">right</option>
      </chart>

its close, but yeah, the 6.6.1 option is way easier to manipulate from the gui

looks like that js will do it, if upgrade is not an imminent thing...

0 Karma

ShaneNewman
Motivator

We are planning an upgrade to a more recent release in the next month or two. Is it safe to assume that this update will be needed for a 6.5.x release as well?

0 Karma

mattymo
Splunk Employee
Splunk Employee

I think you are fine with 6.5

0 Karma

tomm_splunk
Splunk Employee
Splunk Employee

I believe they are running 6.4.4, but will wait for confirmation from @ShaneNewman

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!