Dashboard Background Color Formatting Based on Text

[jtoy1986]

I would like the background to be either Red or Green based on the text of "deviceSeverity." The value of deviceSeverity can either be "Up" or "Down." No matter what I do, the background is staying grey. I am new to Splunk formatting and tried searching through these various messages here, but have not had any luck.

This is the latest that I have and am probably over-complicating things (just want background to be red if deviceSeverity is "Down" and background to be green if deviceSeverity is "Up"):

<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="VIP Health Check Status" deviceSeverity=* 
|  stats latest(deviceSeverity) | eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <refresh>30s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="classField">deviceSeverity</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
        <option name="charting.fieldColors">
        {"severe": 0xFF0000, "low": 0x00FF00, "NULL":0xC4C4C0}
        </option>

[PradReddy]

Hi jtoy1986,

If visualization is a Statistics Table then you can define rules for coloring as below

XML:

<table>
<search>
<query>| makeresults 
| eval deviceSeverity = "Up" 
| append 
[| makeresults 
| eval deviceSeverity = "Down" ] 
| stats latest(deviceSeverity) 
| eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="latest(deviceSeverity)">
<colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette>
</format>
</table>

------

An upvote would be appreciated and Accept Solution if it helps!

[jtoy1986]

I'm getting some validation errors. What am I doing wrong? Some say unknown option name for node "single." And node "Format" is not allowed here. Also getting the following after saving, so assuming query is wrong: "Error in 'makeresults' command: This command must be the first command of a search."

<panel>
      <title>VIP Health Check Status</title>
      <single>
        <title>Host: Components</title>
        <search>
          <query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="VIP Health Check Status" deviceSeverity=* 
|  stats latest(deviceSeverity) | makeresults 
| eval deviceSeverity = "Up" 
| append 
[| makeresults 
| eval deviceSeverity = "Down" ] 
| stats latest(deviceSeverity) 
| eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe") </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <refresh>30s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="latest(deviceSeverity)">
        <colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette>
        </format>
      </single>
    </panel>

[jtoy1986]

I'm also hoping to do the same on some other ones. Basically want to show green or red based on the text that comes back in the query. For example, I am monitoring services and the panel will show "Running" or "Stopped."

deviceSeverity will show either "Running" or "Stopped" below in this case. In my original example, it is "Up" or "Down."

<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="Cyber-Ark Privileged Session Manager" deviceSeverity=*
| stats latest(deviceSeverity)</query>

[jtoy1986]

Anyone else able to provide some insight on where I'm going wrong with my query? I'd love to do this in other dashboards where I can just show red or green based on text.