All Apps and Add-ons

How to make number display viz threshold color based on value?

BigShak
Explorer

Hi there, 

I'd like to custom the color of my spinners based on a specific value. The values are not numeric but string instead (High, medium, low). I know there is an option to set the color directly inside the search query but I don't know how to use it and I can't access to the documentation.

My spinners must look like below image but in only 1 panel instead of 3 : 

BigShak_0-1645614198093.png

Hence, color has to change according to the level (high, medium, low).

Thank you,

Big Big Shak

 

Labels (3)
0 Karma
1 Solution

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

View solution in original post

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

tshah-splunk
Splunk Employee
Splunk Employee

Hey @BigShak,

You can use the XML editor of the dashboard and use the below options in the panel

<format type="color" field="status">
  <colorPalette type="map"> {"Warning":#F7BC38,"OK":#65A637,"Critical":#D93F3C </colorPalette>
</format>

 

PS: status in the format tag represents the field name on which I want to apply color and in the mapping via colorPalette, there should be values mapped to specific colors which in your case would be HIGH, MEDIUM, and LOW.

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

BigShak
Explorer

Hey @tshah-splunk , thanks for your reply.

As it is an add-on (number display viz) it does not allow me to use the XML that you gave me ("Node <format> is not allowed here").

Also, in the details of the add-on it is said that we can use the "color" tag but I don't know how to use it as I struggle to find any example of that.

Thanks.

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...