Help using scale colors depending on the value result

[jip31]

Hello,
Is it possible in the XML below to use scale colors?
If perc result is :

• <5% I want to color the value in green
• between 5 and 25% I want to color the value in orange
• >25% I want to color the value in red

Many thanks

<row id="first">
    <panel>
      <title>Crashes - Volume percentage (%)</title>
      <single id="test">
        <title>Source : Windows Event Viewer (ID 6008) - Slot time : last 30 days</title>
        <search>
          <query>[| inputlookup host.csv 
    | table host] `BSOD` 
| dedup host 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats dc(host) as NbEventCodeHost 
| appendcols 
    [| inputlookup host.csv 
    | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
    | search SITE=$tok_filtersite|s$ 
    | stats dc(host) as NbIndHost 
        ] 
| eval Perc=round((NbEventCodeHost/NbIndHost)*100,2). " %" + " / " + NbIndHost + " machines " 
| table Perc</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x65a637","0xd93f3c","0xd93f3c"]</option>
        <option name="rangeValues">[0,1]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>

[renjith_nair · Accepted solution]

@jip31,

It's possible but the value has to be numeric.

Try this

<row id="first">
     <panel>
       <title>Crashes - Volume percentage (%)</title>
       <single id="test">
         <title>Source : Windows Event Viewer (ID 6008) - Slot time : last 30 days</title>
         <search>
           <query>[| inputlookup host.csv 
     | table host] `BSOD` 
 | dedup host 
 | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
 | search SITE=$tok_filtersite|s$ 
 | stats dc(host) as NbEventCodeHost 
 | appendcols 
     [| inputlookup host.csv 
     | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
     | search SITE=$tok_filtersite|s$ 
     | stats dc(host) as NbIndHost 
         ] 
 | eval Perc=round((NbEventCodeHost/NbIndHost)*100,2)
 | table Perc,NbIndHost</query>
           <earliest>-30d@d</earliest>
           <latest>now</latest>
           <done>
                     <set token="NbInd_Token">$result.NbIndHost$</set>
           </done>
         </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x65a637","0xf1813f","0xd93f3c"]</option>
        <option name="rangeValues">[5,25]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="underLabel">/ $NbInd_Token$ machines</option>
       </single>
     </panel>

[jip31]

thanks renjith
last question
why you have deleted : + " / " + NbIndHost + " machines "?
I need to keep this piece of code and to color it in blue
is it possible??

[renjith_nair]

As mentioned above, single value customization works on numeric values. So if you add the strings to that, then the formatting can not be done.
One option is to use under label option and set the value there. I have updated the answer with that option.
If that's not what you are looking for, then you might need to use either the Status Indicator App or css/js solutions

[jip31]

thanks renjith

[jip31]

hi
i just have an issue with

/ $NbIndHost$ machines
the token doesnt works (see screenshot)
https://www.cjoint.com/c/IGdhqOOpLLd

have you an idea??

[renjith_nair]

@jip31,

As mentioned in the above XML, have you added this part in search tag?

   <latest>now</latest>
            <done>
                      <set token="NbIndHost">$result.NbIndHost$</set>
            </done>
          </search>

[jip31]

Yes
you can see my xml

[| inputlookup host.csv
| table host] index="ai-wkst-wineventlog-fr" sourcetype=XmlWinEventLog source="XmlWinEventLog:System" EventCode=* (Level=1 OR Level=2 OR Level=3)
| dedup host
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
| search SITE=$tok_filtersite|s$
| stats dc(host) as NbEventCodeHost
| appendcols
[| inputlookup host.csv
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
| search SITE=$tok_filtersite|s$
| stats dc(host) as NbIndHost
]
| eval Perc=round((NbEventCodeHost/NbIndHost)*100,2)
| table Perc
-30d@d
now
$result.NbIndHost$


block
["0x65a637","0xf1813f","0xd93f3c"]
[5,25]
progressbar
absolute
%
1
/ $NbIndHost$ machines

[renjith_nair]

Not able to see the xml. can you put them in code to avoid the xml truncate?

[jip31]

HERE IS THE CODE

[renjith_nair]

"You dont need to use Capital letters , "just saying"

in your search , you missed to add NbIndHost with the table command which is in the actual XML I pasted

i.e.

    | table Perc,NbIndHost

[jip31]

oh sorry its exact
I didnt see that you added this in table
thanks

[jip31]

But I found a second issue

$result.NbIndHost$ is linked to a dropdown list like you can see in `| search SITE=$tok_filtersite|s$ `

but when I am doing a choice in | search SITE=$tok_filtersite|s$ the result in $result.NbIndHost$ doesnt change
Have you an idea please??

[renjith_nair]

Updated the answer to change the token name just to avoid confusions

token name has been changed from NbIndHost to NbInd_Token

Regarding your question, when you change the token , does the value under the field NbIndHost change? You can view that by opening the search

[jip31]

like this is correct!

[renjith_nair]

is it working for you or do you have still issues?

[jip31]

its ok thanks!

[jip31]

<panel>
      <title>TEST</title>
      <single>
        <title>TEST</title>
        <search>
          <query>[| inputlookup host.csv 
    | table host] index="ai-wkst-wineventlog-fr" sourcetype=XmlWinEventLog source="XmlWinEventLog:System" EventCode=* (Level=1 OR Level=2 OR Level=3) 
| dedup host 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats dc(host) as NbEventCodeHost 
| appendcols 
    [| inputlookup host.csv 
    | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
    | search SITE=$tok_filtersite|s$ 
    | stats dc(host) as NbIndHost 
        ] 
| eval Perc=round((NbEventCodeHost/NbIndHost)*100,2)
| table Perc</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest><done>
                       <set token="NbIndHost">$result.NbIndHost$</set>
             </done>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x65a637","0xf1813f","0xd93f3c"]</option>
        <option name="rangeValues">[5,25]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="underLabel">/ $NbIndHost$ machines</option>
      </single>
    </panel>