How to change Cluster colours in Map+?

[mh124]

Hi All,

Can I change cluster colours based on such code?

| eval clusterGroup=case(bgp_state="Down","red",bgp_state="down","red",bgp_state="Up","green",bgp_state="up","green",bgp_state="null","green" )

<option name="leaflet_maps_app.maps-plus.clusterGroupColors">green:#00ff00, red:#ff0000</option>

Thank You in advance for the help

[tscroggins]

Hi @mh124,

Maps+ uses clustering by default, and each cluster must normally have at least two results. To allow single results to display stylized markers, set the leaflet_maps_app.maps-plus.singleMarkerMode option to 1:

<viz type="leaflet_maps_app.maps-plus">
  <search>
    <query>| makeresults format=csv data="
latitude,longitude,bgp_state
37.166111,-119.449444,Down
42.9525,-76.016667,Up
42.9525,-76.016667,Up
42.9525,-76.016667,Up
"
| eval clusterGroup=coalesce(lower(bgp_state), "up")
| table latitude longitude clusterGroup</query>
    <earliest>0</earliest>
    <latest>now</latest>
  </search>
  <option name="drilldown">none</option>
  <option name="leaflet_maps_app.maps-plus.cluster">1</option>
  <option name="leaflet_maps_app.maps-plus.clusterGroupColors">down:red, up:green</option>
  <option name="leaflet_maps_app.maps-plus.singleMarkerMode">1</option>
</viz>

The singleMarkerMode option is loosely documented in app help:

Single Marker Mode

Re-style single marker icon to marker cluster style (round) - Requires browser Refresh

In the Format visualization interface, navigate to Clustering > Single Marker Mode, and then click Enabled.

[mh124]

Thank You @tscroggins ,

It's still unclear for me if I can overwrite default cluster colour settings below. I think that Maps+ is still counting devices under cluster and color depends on this value:

[bowesmana]

See the doc section on Cluster Groups where it describes the fields needed to change the cluster colour definitions

https://github.com/sghaskell/maps-plus?tab=readme-ov-file#cluster-groups

[mh124]

Hi bowesmana,

I have already tried it, you can see below. It does not work:

| eval clusterFgColor=case(bgp_state="Down", "#ff0000", bgp_state="Up", "#00ff00", bgp_state="down", "#ff0000", bgp_state="up", "#00ff00", bgp_state="null", "#00ff00")
| eval clusterBgColor=case(bgp_state="Down", "#ff0000", bgp_state="Up", "#00ff00", bgp_state="down", "#ff0000", bgp_state="up", "#00ff00", bgp_state="null", "#00ff00")

Thanks

[bowesmana]

If you are having an issue with single marker clustering, then @tscroggins shows the solution for that, however, both your original clusterGroupColors setting and this post should work

This example shows random dynamic changes to foreground and background colours.

  <row>
    <panel>
      <viz type="leaflet_maps_app.maps-plus">
        <search>
          <query>| makeresults format=csv data="latitude,longitude
-33.7688,150.9063
-32.2773,115.7316
-27.4698,153.0251
-34.727,138.6689
-19.259,146.8169
-33.8688,151.2093
-37.9145,145.1195
-31.7467,115.7677
-33.7688,150.9063"
| eval bgp_state=mvindex(split("Down,Up",","), random() % 2)
| eval state=lower(bgp_state)
| eval clusterGroup=case(state="down","red",state="up","green",bgp_state="null","green")
| streamstats c 
| eval setBg=if(state="up", "green,blue", "red,orange")
| eval setFg=if(state="up", "white,yellow", "black,grey")
| eval clusterBgColor=mvindex(split(setBg, ","), random() % 2)
| eval clusterFgColor=mvindex(split(setFg, ","), random() % 2)
| eval description=printf("&lt;b&gt;Item %d - %s&lt;/b&gt;", c, bgp_state), tooltip=description</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="leaflet_maps_app.maps-plus.cluster">1</option>
        <option name="leaflet_maps_app.maps-plus.singleMarkerMode">1</option>
        <option name="refresh.display">progressbar</option>
      </viz>
    </panel>
  </row>

[mh124]

Hi bowesmana,

I have pasted this code and I still see only "green" color for clusters:

Thank YouDown state should be in "red" colour?

[bowesmana]

This is what is should look like (I made is use odd colours for up/down just to show it's possible)

I know that Maps+ is a bit odd in that you need to refresh the browser tab to get some changes recognised, but what version of Maps+ are you - this is the latest 4.6.2 in SplunkCloud

[mh124 · Accepted solution]

Hello bowesmana,

Thank You very much. This problem is related to the Chrome 141. 
All works as expected!

Best Regards