Dashboards & Visualizations

How do I color the background based on Time Conditions?

Vaale
New Member
  • Before 7:05                         – green
  • Between 7:05 and 7:45 – yellow
  • After 7: 45                           – red

Vaale_0-1669679915067.png

How can I implement this logic in Splunk?

Vaale_1-1669680225604.png

written a Javascript logic but its throwing an error where < and > are used.

Can someone please help me to process this? Thanks in Advance. !

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't put JS inside the XML, you have to add JS files to appserver/static and reference them from the dashboard with <form script="myjs.js">

However, if you're just looking to colour boxes, then see this example dashboard that uses conditions to set colours - 3 examples.

You can use either of the fist two techniques to colour the box

<dashboard>
  <label>colour_box</label>
  <row>
    <panel depends="$hide_css$">
      <html>
        <style>
          #verdict rect {
            fill: $verdict_background$ !important;
          }
          #verdict text {
            fill: $verdict_foreground$ !important;
          }
        </style>
      </html>
    </panel>
    <panel>
      <single id="verdict">
        <title>Verdict - use CSS to style box</title>
        <search>
          <query>| makeresults
          | eval verdict=mvindex(split("Pass,Fail",","), random() % 2)
          </query>
          <done>
            <eval token="verdict_background">if($result.verdict$="Pass", "green", "red")</eval>
            <set token="verdict_foreground">black</set>
          </done>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="height">60</option>
        <option name="rangeColors">["0x53a051","0xdc4e41"]</option>
        <option name="rangeValues">[0]</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Verdict 2 - define range based on pass/fail verdict</title>
        <search>
          <query>| makeresults
          | eval verdict=mvindex(split("Pass,Fail",","), random() % 2)
          | eval range=if(verdict=="Pass", "low", "severe")
          | table verdict range
          </query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="height">60</option>
        <option name="field">verdict</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Time Age - more than 3 days is red</title>
        <search>
          <query>| makeresults
          | eval timestamp=now() - (random() % 7) * 86400
          | eval range=if(timestamp &lt; relative_time(now(), "-3d"), "severe", "low")
          | eval timestamp=strftime(timestamp, "%F %T")
          | table timestamp range</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="field">timestamp</option>
        <option name="height">60</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</dashboard>

 

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...