Dashboards & Visualizations

Configure static color by value in splunk dashboard studio

vananhnguyen
Loves-to-Learn

I am having some dashboards created by Splunk Dashboard Studio. Anyone know where I could set static color based on values in the dashboard? Thanks much!

Labels (1)
0 Karma

renjith_nair
Legend

@vananhnguyen ,

Here is a run anywhere example. Are you looking for something like this ? You can change the value in the dropdown and the colors will be reset

{
    "visualizations": {
        "viz_NJsTjQl4": {
            "type": "splunk.singlevalue",
            "options": {
                "majorColor": "> majorValue | matchValue(majorColorEditorConfig)"
            },
            "dataSources": {
                "primary": "ds_275I8YNY"
            },
            "context": {
                "majorColorEditorConfig": [
                    {
                        "match": "Running",
                        "value": "#118832"
                    },
                    {
                        "match": "Stopped",
                        "value": "#d41f1f"
                    }
                ]
            }
        }
    },
    "dataSources": {
        "ds_275I8YNY": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| eval value=\"$status$\""
            },
            "name": "Search_1"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        },
        "input_BHJAbWl2": {
            "options": {
                "items": [
                    {
                        "label": "Running",
                        "value": "Running"
                    },
                    {
                        "label": "Stopped",
                        "value": "Stopped"
                    }
                ],
                "token": "status",
                "selectFirstSearchResult": true
            },
            "title": "Status",
            "type": "input.dropdown"
        }
    },
    "layout": {
        "type": "grid",
        "options": {
            "width": 1440,
            "height": 960
        },
        "structure": [
            {
                "item": "viz_NJsTjQl4",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 1440,
                    "h": 400
                }
            }
        ],
        "globalInputs": [
            "input_global_trp",
            "input_BHJAbWl2"
        ]
    },
    "description": "",
    "title": "single_panel_studio"
}

 

Reference : https://docs.splunk.com/Documentation/Splunk/9.2.1/DashStudio/visualEditDynamic 

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

vananhnguyen
Loves-to-Learn

Hi @renjith_nair. Thank you but  it's not something i am looking for. I have a column chart to visualize the status of requests to a website. Each time the dashboard is refreshed, the number of status displayed changes and the color of the columns may change. How can I configure a fixed color for each status value?

vananhnguyen_0-1713935556140.png

 

0 Karma

renjith_nair
Legend

@vananhnguyen 
For that we need to know what value comes to map it with a color. 

We can transpose the result and set the result as column values and set the colors.

Please check the following run anywhere example. makeresults is just used to create a set of dummy data

{
    "visualizations": {
        "viz_PKMJkTej": {
            "type": "splunk.column",
            "options": {
                "y": "> primary | frameBySeriesNames('count','Critical','Failure','Info','Success')",
                "seriesColorsByField": {
                    "Critical": "#dc4e41",
                    "Failure": "#f8be34",
                    "Success": "#53a051",
                    "Info": "#0051B5"
                },
                "x": "> primary | seriesByName('count')",
                "y2": "> primary | frameBySeriesNames('Critical','Failure','Info','Success')"
            },
            "dataSources": {
                "primary": "ds_Lmyq9G4p"
            }
        }
    },
    "dataSources": {
        "ds_Lmyq9G4p": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults count=100 \n| eval value=random() \n| eval status=case(value%2==0,\"Success\",value%3==0,\"Failure\",value%4==0,\"Warning\",value%5==0,\"Critical\",1==1,\"Info\") \n| stats count by status \n| transpose header_field=status column_name=count"
            },
            "name": "Search_1"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_PKMJkTej",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 1010,
                    "h": 300
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    },
    "description": "",
    "title": "Static Colors"
}
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...