Dashboards & Visualizations

How to change a single panel color based on text result?

N1ghtCrawler
New Member

I'm working on creating a dashboard with a single panel view. My search is determining if i'm processing data in x, y or x+y. I can get the dashboard to correctly display the location but i'd like to have a color associated with each location. I've tried assigning a value to the location which then i can get the color to correctly appear but my associated number is listed in my dashboard and not the actual location. I've poured over these forums and google, not having much luck at least with how i'm currently restricted by my company.

| eval Location=case(like(host, "%ksc%"),"KSC",like(host, "%stl%"),"STL") | stats count by Location | eval Location=case(count > 10,Location) | dedup Location | eventstats count as "LocCount" | eval Location=if(LocCount > 1,"Co-Processing", Location) | eval Location=case(Location="KSC", 0, Location="STL", 5, Location="Co-Processing", 10) | stats values(Location)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@N1ghtCrawler ,

Try this run anywhere example. You shall just change the search and colors according to your requirement

<dashboard>
  <label>Color My Text</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| inputlookup geo_attr_countries.csv|table region_un|head 3
                 | eval color=case(region_un="Americas",1,region_un="Asia",2,region_un="Africa",3)|rangemap field=color low=1-1 medium=2-2,high=3-3</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">large</option>
        <option name="trellis.splitBy">_aggregation</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@N1ghtCrawler ,

Try this run anywhere example. You shall just change the search and colors according to your requirement

<dashboard>
  <label>Color My Text</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| inputlookup geo_attr_countries.csv|table region_un|head 3
                 | eval color=case(region_un="Americas",1,region_un="Asia",2,region_un="Africa",3)|rangemap field=color low=1-1 medium=2-2,high=3-3</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">large</option>
        <option name="trellis.splitBy">_aggregation</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
Happy Splunking!

N1ghtCrawler
New Member

Thank you so much! After a little tweaking i was able to get the results i was looking for.

0 Karma

niketn
Legend

@N1ghtCrawler be careful while using rangemap in Single Value for applying color based on text, any editing of Single value map override colors. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap...

Refer to another answer on similar lines where Simple XML JS Extension has been used to apply color based on Values: https://answers.splunk.com/answers/583539/can-we-set-two-different-colors-for-single-value-a.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...