How are the Min and Max color settings determined for the Single Value visualization in Splunk 6.3?

[pepper_seattle]

Hello,

In the new (6.3) version of Splunk, the single value visualization can be set with specific colors depending on a min/max range setting.

Questions:
How is the min/max setting determined?
If I need to use two colors, one representing negative values (ex: -5) and one representing positive values (ex: 5) how would this be done given that whatever number is input for min-# becomes the min for the next max value (ex: min-100, 100-Max)?
Can you only assign these colors to numerical results or is there a way to assign them to strings in the xml?

[frobinson_splun · Accepted solution]

Hi @pepper_seattle,
Here is some documentation about working with ranges and colors for single value visualizations:
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Visualizationreference#Customize_ranges_and_co...

I think you'll find that the max value for any particular range is colored according to that range. For instance, if you map a range from 1-5 to the color yellow, then 5 appears yellow. Anything over 5 falls into the next range above it. You are correct that 5 would also appear as the "min" value in the next range up, but it is not interpreted as part of that next range.

I'm not sure what you mean about assigning strings to ranges in the xml. Could you give an example of what you're trying to do?

Hope this helps,
@frobinson_splunk

[pepper_seattle]

By assigning strings to ranges I meant, would it be possible to have results which appear as a string like 'bad' or 'good' and assign coloring to it.

[frobinson_splun]

Hi @pepper_seattle,
I see what you mean--thanks for the details. Single value visualizations work with numbers, so you can't generate string results for a single value, at least at this time.

You can use labels and colors together to give more contextual info as part of your single value visualization, though. Check out the examples here:
https://splunkbase.splunk.com/app/1603/
Best,
@frobinson_splunk

[MuS]

Single value visualisation works on strings as well 😉 check out this answer here https://answers.splunk.com/answers/329368/color-string-fields-in-stats-dashboard.html

[frobinson_splun]

An interesting option! The only caveat: it is not generally recommended to use the "rangemap" command for new single value visualizations in 6.3, as UI formatting overrides any settings from "rangemap".

I suppose, depending on a user's expectations, that there might be exceptions to this rule. However, expected formatting results might not be supported. Maybe there is an additional workaround to get away from rangemap? 🙂

[MuS]

Sadly this work around does no longer work https://answers.splunk.com/answers/241650/using-eval-to-change-text-color-in-single-value-mo.html well at least I got it not working so far.....

[frobinson_splun]

Ah, thank you for testing it out! I'll pass these notes along to our team 🙂