All Apps and Add-ons

How to make number display viz threshold color based on value?

BigShak
Explorer

Hi there, 

I'd like to custom the color of my spinners based on a specific value. The values are not numeric but string instead (High, medium, low). I know there is an option to set the color directly inside the search query but I don't know how to use it and I can't access to the documentation.

My spinners must look like below image but in only 1 panel instead of 3 : 

BigShak_0-1645614198093.png

Hence, color has to change according to the level (high, medium, low).

Thank you,

Big Big Shak

 

Labels (3)
0 Karma
1 Solution

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

View solution in original post

BigShak
Explorer

Found the solution. Just need to add a field primarycolor (and eventually secondarycolor) and bind the value with a case function. See my example below:

[search]
| eval primarycolor=case(severity="HIGH", "#FFFFFF", severity="MEDIUM", "#FFFFFF", severity="LOW", "#FFFFFF")
| eval secondarycolor=primarycolor

Just replace "FFFFFF" by the HEX color code you need and it's all good man.

Big Big Shak.

tshah-splunk
Splunk Employee
Splunk Employee

Hey @BigShak,

You can use the XML editor of the dashboard and use the below options in the panel

<format type="color" field="status">
  <colorPalette type="map"> {"Warning":#F7BC38,"OK":#65A637,"Critical":#D93F3C </colorPalette>
</format>

 

PS: status in the format tag represents the field name on which I want to apply color and in the mapping via colorPalette, there should be values mapped to specific colors which in your case would be HIGH, MEDIUM, and LOW.

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

BigShak
Explorer

Hey @tshah-splunk , thanks for your reply.

As it is an add-on (number display viz) it does not allow me to use the XML that you gave me ("Node <format> is not allowed here").

Also, in the details of the add-on it is said that we can use the "color" tag but I don't know how to use it as I struggle to find any example of that.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...