All Apps and Add-ons

How to make number display viz threshold color based on value?

BigShak
Explorer

Hi there, 

I'd like to custom the color of my spinners based on a specific value. The values are not numeric but string instead (High, medium, low). I know there is an option to set the color directly inside the search query but I don't know how to use it and I can't access to the documentation.

My spinners must look like below image but in only 1 panel instead of 3 : 

BigShak_0-1645614198093.png

Hence, color has to change according to the level (high, medium, low).

Thank you,

Big Big Shak

 

Labels (3)
0 Karma
1 Solution

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

View solution in original post

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

tshah-splunk
Splunk Employee
Splunk Employee

Hey @BigShak,

You can use the XML editor of the dashboard and use the below options in the panel

<format type="color" field="status">
  <colorPalette type="map"> {"Warning":#F7BC38,"OK":#65A637,"Critical":#D93F3C </colorPalette>
</format>

 

PS: status in the format tag represents the field name on which I want to apply color and in the mapping via colorPalette, there should be values mapped to specific colors which in your case would be HIGH, MEDIUM, and LOW.

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

BigShak
Explorer

Hey @tshah-splunk , thanks for your reply.

As it is an add-on (number display viz) it does not allow me to use the XML that you gave me ("Node <format> is not allowed here").

Also, in the details of the add-on it is said that we can use the "color" tag but I don't know how to use it as I struggle to find any example of that.

Thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...