Dashboards & Visualizations

Change Single Value Visualization Based on Text

mistydennis
Communicator

Hello - I realize this question has been asked several times before and I've tried to implement every solution I've found, but nothing seems to be working.

I simply want to update a single value visualization based on the text. If "Yes", then green, and if "No", red. 

I've tried using older solutions involving rangemap and changing some of the charting options, but I'm not having any luck in v9.3.0. 

| inputlookup mylookup.csv 
| search $time_tok$ $field_tok$=Y 
| stats max(Distance) AS GuideMiles 
| appendcols 
    [| mylookup.csv 
    | search $month_tok$ 
    | stats max(TargetMiles)] 
| rename max(TargetMiles) AS TargetMiles 
| eval OnTarget=case(GuideMiles>=TargetMiles,"Yes", true(), "No") 
| table OnTarget

 

Labels (1)
0 Karma
1 Solution

uagraw01
Motivator

@mistydennis 

### Steps to Use Single Value Visualization in your dashboard.

1. **Run the Query**: Use the query you provided to generate the `OnTarget` value.

2. **Select Visualization**:
- After running the query, go to the **Visualization** tab in the search results.
- From the available visualizations, choose **Single Value**.

3. **Configure Conditional Coloring**:
- Click on **Format** in the Visualization tab.
- Under **Color**, enable **Color by value**.
- Add your conditions:
- **If value is "Yes"**: Set the color to green.
- **If value is "No"**: Set the color to red.

4. **Save and Use**:
- Apply the settings, and you will see the value displayed either in green or red based on the result ("Yes" or "No").
- You can then save this as part of your dashboard if needed.

upvote is appreciated.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

While you have clearly shown your search (which by the way seems perfectly fine), what you haven't shown or described is what you have tried in your dashboard. Please can you provide further information?

Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...