Dashboards & Visualizations

Change Cluster Map Color to solid color with error

nwoodco1
Explorer

Hello, I am trying to make it so that my cluster map pie chart turns all one color when there is an event containing an error. So instead of being mostly green with a little bit of red, I would like the whole pie to turn red. Thanks!

0 Karma

efavreau
Motivator

Are you changing the values if there's an error? Because you could end your search with an eval if errors >0, events=errors, which could turn it all red (let's say errors is red and non-errors is green). But then your green wouldn't show at all. Yyou probably wouldn't want to do that though. You could turn the background white or red based on an eval for errors and adjusting the CSS. The easiest route might be to add a status indicator panel next to it, showing only the icon, and it evaluates if errors >0.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...