Change background color according to query status

[pshangguan]

I have a single value dashboard panel, it displays the status of from a query. I hav the following query that changes the display text color according to the query status.

index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | sort -_time | stats latest(job_result) as dev2status, latest(_time) as dev3t | eval PST=dev3t-25200 | eval Dev2Time=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval host="DEV2" | fields host dev2status Dev2Time | head 1 | eval range=if(dev2status=="FAILURE", "severe", "low")

Now I want to change the background color to either RED or GREEN by the status(SUCCESS or FAILURE), keep the text color as default BLACK.

What I need to do?

Thanks!

[niketn]

@pshangguan seems like you need Status Indicator Custom Visualization.

Once you have the Status Indicator Custom Visualization, you can try out the following run anywhere example:

<dashboard>
  <label>Status Indicator with Text Icon and Color based on Count</label>
  <row>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>index=_internal sourcetype=splunkd log_level="ERROR"
| stats count by sourcetype
| eval range=case(count>0 AND count<=20,"green",count>20 AND count<=50,"yellow",true(),"red")
| eval icon="server"
| table sourcetype icon range count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

Please try out and confirm!

[493669 · Accepted solution]

have a look at answer by @niketnilay ,
https://answers.splunk.com/answers/541893/changeset-color-of-single-value-visualization-text.html

[pshangguan]

I will try and see how far I an go with this... Thanks now.

[pshangguan]

I tried to use the following code:

    <option name="colorBy">value</option>
    <option name="colorMode">block</option>
    <option name="drilldown">none</option>
    <option name="numberPrecision">0.00</option>
    <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
    <option name="rangeValues">[4,4.5]</option>

It always display red background.

What I want is to display the environment name in the single value panel, but use "job_result" to decide what color to use. The value for "colorBy" only takes numbers.