All Apps and Add-ons

How to configure dashboard to show green or red by percentage trend?

jyoung1001
New Member

Hi

Current dashboard trends color are red or green. If the trend is up then color is green otherwise it red (regardless how much % is down.)

I would like the dashboard to show a certain color depending on the percentage, not just positive and negative.

So for example,

The background color of each panel should change depending on the percentage number.
The panel background color should be red if the percentage is below -4.
The panel background color should be green if the percentage is above +4.
The panel background color should be gray if the the percentage is between -4 and +4.

I am working on using the XML configuration and have been trying to edit it with an overriding js script

Thanks in advance,

0 Karma

poete
Builder

Hello @jyoung1001,

this should do it:
In this example, the backgrond color changes depending on the content of the <option name="rangeValues"> tag
These corresponding colors are configured in the <option name="rangeColors"> tag.

For more info, please check : https://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/SingleValueFormatting

   <panel>
      <title></title>
      <single>
        <title></title>
        <search>
          <query>start of your search|  timechart  avg(somevalue) span=1m</query>
          <earliest>-24h@h</earliest>
          <latest>@m</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">143</option>
        <option name="numberPrecision">0.0</option>
        <option name="rangeColors">["0x0E31EB","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[-10,60,70,80]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">inverse</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-1h</option>
        <option name="underLabel">$generalSingleValueUsage$</option>
        <option name="unit">%</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
...
      </single>
0 Karma

niketn
Legend

@jyoung1001, Which visualization is this for? Are you using Chart, Single Value, Status Indicator, Table or something else? Which version of Splunk are you on? Please add more details on expected output (mock screenshot/sample data and fields etc). Also what you have tried so far?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jyoung1001
New Member

@niketnilay,

I am using the Single Value visualization and Splunk enterprise v. 6.3.4.

I have some screenshots of what I'm trying to do, but I don't have enough karma to post them.

Basically, i just want to set the limits for when the colors change in the panels. So instead of it just being positive and negative trends, with 0 being grey. I want above 4 green, below -4 red, and between -4 & 4 as gray.

Did that clear things up?

0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...