Archive
Highlighted

Add Color to a Single Value Chart

Path Finder

I am trying to add color to a single value chart. The 1000 is the goal and it changes based on the number of days the search pulls.
Here is my search.

index=Foo ShiftName=1 MachineNumber<26 NumberOfGGRollPaths ElapsedMachineFootageInOrderPath
| eval "Square Yards"= (NumberOfGGRollPaths * ElapsedMachineFootageInOrderPath)*0.66667
| stats dc(_time) as numberofuniquedays sum("Square Yards") as SQYDS
| chart sum(SQYDS)
| eval Scale = (SQYDS/(numberofuniquedays * 1000))
| rangemap field=Scale green=1000-1 yellow=0.8-0.5 red=0.5-0

I can't get the chart to change a color. Please help.

Tags (1)
0 Karma
Highlighted

Re: Add Color to a Single Value Chart

SplunkTrust
SplunkTrust

I'm not sure if there is a way to do this within the search itself but you can do it by editing the dashboard panel XML. Here is a link to the single value XML options for reference: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#single_value

What this might look like is:

     <panel>
      <title>Panel Title</title>
      <single>
        <search>
          <query>index=Foo ShiftName=1 MachineNumber<26 NumberOfGGRollPaths ElapsedMachineFootageInOrderPath
| eval "Square Yards"= (NumberOfGGRollPaths * ElapsedMachineFootageInOrderPath)0.66667 
| stats dc(_time) as numberofuniquedays sum("Square Yards") as SQYDS 
| chart sum(SQYDS)
| eval Scale = (SQYDS/(numberofuniquedays 1000)) 
| rangemap field=Scale green=1000-1 yellow=0.8-0.5 red=0.5-0</query>
        </search>
        <option name="colorBy">value</option>
        <option name="field">Scale</option>
        <option name="useColors">true</option>
        <option name="rangeColors">#00ff00,#ffffe0,#ff0000</option>
        <option name="rangeValues">999,0.8,0.5</option>
      </single>
    </panel>

This might take a little bit of tweaking yet but is the general idea. There are other options available for the Single Value viz documented in those XML docs as well.

0 Karma