Change single value color based on textual value

[DavidHourani]

Hello,

I have a single value panel displaying "KO", "WARNING", "OK" and I would like to add colors to it.. By default colors can be added to numbers based on the range but I wish to display the text and change the color based on the text value.

Any idea how I can do this, which option in XML should I modify ?

Regards,
David

[3no · Accepted solution]

Hello David,

You can use range in your search :

| eval range=if(your_field_name==your_field_value, "severe", "low") 

Then in simple XML :

<option name="field">field_name</option>

3no

[DavidHourani]

what are the possible values for range beside severe, low ?

[3no]

also elevated and default

[niketn]

@DavidHourani you can choose between

low, guarded, elevated, high, severe or direct color names like green, blue, yellow, orange, red

| eval range=case(your_field_name==your_field_value1, "severe", your_field_name==your_field_value2,"high",your_field_name==your_field_value3,"low",true(),"low")

Read the following documentation, also make sure no-one edits the UI configuration for the Single Value panel: http://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap_...

[adonio]

Hello DavidHourani,
check this answer, maybe it can help:
https://answers.splunk.com/answers/338154/change-color-of-splunk-graph-based-on-string-value.html