How to change a single panel color based on text result?

[N1ghtCrawler]

I'm working on creating a dashboard with a single panel view. My search is determining if i'm processing data in x, y or x+y. I can get the dashboard to correctly display the location but i'd like to have a color associated with each location. I've tried assigning a value to the location which then i can get the color to correctly appear but my associated number is listed in my dashboard and not the actual location. I've poured over these forums and google, not having much luck at least with how i'm currently restricted by my company.

| eval Location=case(like(host, "%ksc%"),"KSC",like(host, "%stl%"),"STL") | stats count by Location | eval Location=case(count > 10,Location) | dedup Location | eventstats count as "LocCount" | eval Location=if(LocCount > 1,"Co-Processing", Location) | eval Location=case(Location="KSC", 0, Location="STL", 5, Location="Co-Processing", 10) | stats values(Location)

[renjith_nair · Accepted solution]

@N1ghtCrawler ,

Try this run anywhere example. You shall just change the search and colors according to your requirement

<dashboard>
  <label>Color My Text</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| inputlookup geo_attr_countries.csv|table region_un|head 3
                 | eval color=case(region_un="Americas",1,region_un="Asia",2,region_un="Africa",3)|rangemap field=color low=1-1 medium=2-2,high=3-3</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">large</option>
        <option name="trellis.splitBy">_aggregation</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

[N1ghtCrawler]

Thank you so much! After a little tweaking i was able to get the results i was looking for.

[niketn]

@N1ghtCrawler be careful while using rangemap in Single Value for applying color based on text, any editing of Single value map override colors. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap...

Refer to another answer on similar lines where Simple XML JS Extension has been used to apply color based on Values: https://answers.splunk.com/answers/583539/can-we-set-two-different-colors-for-single-value-a.html