All Apps and Add-ons

How to make number display viz threshold color based on value?

BigShak
Explorer

Hi there, 

I'd like to custom the color of my spinners based on a specific value. The values are not numeric but string instead (High, medium, low). I know there is an option to set the color directly inside the search query but I don't know how to use it and I can't access to the documentation.

My spinners must look like below image but in only 1 panel instead of 3 : 

BigShak_0-1645614198093.png

Hence, color has to change according to the level (high, medium, low).

Thank you,

Big Big Shak

 

Labels (3)
0 Karma
1 Solution

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

View solution in original post

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

tshah-splunk
Splunk Employee
Splunk Employee

Hey @BigShak,

You can use the XML editor of the dashboard and use the below options in the panel

<format type="color" field="status">
  <colorPalette type="map"> {"Warning":#F7BC38,"OK":#65A637,"Critical":#D93F3C </colorPalette>
</format>

 

PS: status in the format tag represents the field name on which I want to apply color and in the mapping via colorPalette, there should be values mapped to specific colors which in your case would be HIGH, MEDIUM, and LOW.

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

BigShak
Explorer

Hey @tshah-splunk , thanks for your reply.

As it is an add-on (number display viz) it does not allow me to use the XML that you gave me ("Node <format> is not allowed here").

Also, in the details of the add-on it is said that we can use the "color" tag but I don't know how to use it as I struggle to find any example of that.

Thanks.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...