How to apply a default colour to a single-line visual box with text instead of numbers

[mansel_scheffel]

Hi,

I need to change the default colour of a group of single line visuals..They are pulling in text from a lookup.. The default colour needs to be red, not black, but as there are no numeric values, the range obviously doesnt work.

Any thoughts on how I can set a default colour?

[kbarker302 · Accepted solution]

One approach would be to add something like the following to the end of your query:

| eval color=1 | rangemap field=color default=severe   

and add this option to your single value XML:

<option name="classField">color</option>

Below is a complete example that worked for me:

  <single>
    <search>
      <query>index=_internal | head 1 | eval myday=strftime(_time,"%A")             
        | fields myday          
        | eval color=1 | rangemap field=color default=severe 
      </query>
      <earliest></earliest>
      <latest></latest>
    </search>
    <option name="classField">color</option>
  </single>

This is a variation of an approach that is described here:

https://answers.splunk.com/answers/103239/change-color-of-single-value-visualization.html

Depending on how comfortable you are with CSS, another approach would be to include a custom CSS file that overrides the single-result class.

[MaryvonneMB]

I'm not sure what single-line visual is, but if you have it in a dashboard you can deal with options in SimpleXML:
try to add
<option name="charting.seriesColors">[990000]</option>to your chart
http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/ChartConfigurationReference