Dashboards & Visualizations

Change Cluster Map Color to solid color with error

nwoodco1
Explorer

Hello, I am trying to make it so that my cluster map pie chart turns all one color when there is an event containing an error. So instead of being mostly green with a little bit of red, I would like the whole pie to turn red. Thanks!

0 Karma

efavreau
Motivator

Are you changing the values if there's an error? Because you could end your search with an eval if errors >0, events=errors, which could turn it all red (let's say errors is red and non-errors is green). But then your green wouldn't show at all. Yyou probably wouldn't want to do that though. You could turn the background white or red based on an eval for errors and adjusting the CSS. The easiest route might be to add a status indicator panel next to it, showing only the icon, and it evaluates if errors >0.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...