Hello, is it possible to change the color of the Single Value Visualization based on a time value of the search result.
I get a timestamp as a search result and would like to make the text of the visualization red if the timestamp is from more than 3 days ago.
Thanks for your help!
Here's an example dashboard that changes the colour to red if it's >3 days old
Example just creates a random 'age' and it will either be red or green.
Note - it uses 'range' field to determine colour.
<dashboard>
<label>tst2</label>
<row>
<panel>
<single>
<title>Time Age</title>
<search>
<query>| makeresults
| eval timestamp=now() - (random() % 7) * 86400
| eval range=if(timestamp < relative_time(now(), "-3d"), "severe", "low")
| eval timestamp=strftime(timestamp, "%F %T")
| table timestamp range</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="field">timestamp</option>
<option name="height">60</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>
Here's an example dashboard that changes the colour to red if it's >3 days old
Example just creates a random 'age' and it will either be red or green.
Note - it uses 'range' field to determine colour.
<dashboard>
<label>tst2</label>
<row>
<panel>
<single>
<title>Time Age</title>
<search>
<query>| makeresults
| eval timestamp=now() - (random() % 7) * 86400
| eval range=if(timestamp < relative_time(now(), "-3d"), "severe", "low")
| eval timestamp=strftime(timestamp, "%F %T")
| table timestamp range</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="field">timestamp</option>
<option name="height">60</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>