How to change value in single value visualization based on numeric and string values.

[sbhatnagar88]

HI,

How can I change color of panel based on numeric and string.

For Example-

| inputlookup host_availability.csv
| eval host=upper(host)
| join host
[| inputlookup data.csv
| search host=* Environment="*" Application="ABC" ]
| stats avg(%Availability) as availability
| eval availability=round(availability,3)
| fillnull value=NA availability
| fields availability

---

If there is some numeric value in availability field, we know colours can be changed based upon "colour by value" field.

Question is - If my value is "NA", i need colour to be changed to grey(showing as grayed out). How can I define this.

Thanks

[niketn]

@sbhatnagar88 if you are using Single Value visualization with Block color this should be default behavior.

I have created a dummy run anywhere dashboard for you to test this with internal index. Reduce the time in Time Picker so that there are no Error in Splunk for selected time frame (like Last 15 minute), you will get null value which will show up as NA. Due to block color mode the color range will not get applied and entire single value panel will show Grey color. Please try out and confirm!

<form>
  <label>Single Value Filled by Range and NA as Grey</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTIme" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </default>
      </input>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd
| stats count as Total count(eval(log_level=="ERROR")) as ERROR
| eval Availability=Total/ERROR
| fillnull value="NA" Availability
| table Availability</query>
          <earliest>$tokTIme.earliest$</earliest>
          <latest>$tokTIme.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x53a051","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[95,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
    </panel>
  </row>
</form>

[gaurav_maniar]

Hi

You can do it by using rangemap command and define your own color mapping.

|makeresults | eval availability="NA" | rangemap field=availability default=gray

Now set your range colors from panel options.

Please upvote and accept the answers if it works for you.

[sbhatnagar88]

Hi Gaurav,

Unfortunately , its not working...By Default black colour is coming and its not changing.

Thanks

[gaurav_maniar]

Hi,

Which Splunk version you are using?

Try with below XML code (if the below code doesn't work there may be issue with field values. Share your XML code, query and sample results, )
First test the XML code by changing value in makeresult query, if works fine that replace it with your query.

<row>
    <panel>
      <single>
        <search>
          <query>|makeresults | eval availability="NA" | rangemap field=availability default=gray</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="field">state</option>
        <option name="rangeColors">["0xd93f3c","0xf7bc38","0x65a637"]</option>
        <option name="rangeValues">[25,50]</option>
        <option name="showTrendIndicator">0</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>

[niketn]

@gaurav_maniar as per Splunk Documentation rangemap should not be used for coloring Single Value visualization as the same will get overridden in case dashboard panel is edited. https://answers.splunk.com/answers/715473/range-map-is-not-working-properly-in-splunk-653.html

You should use UI Edit or in case of complex logic, use Simple XML JS Extension https://answers.splunk.com/answers/583539/can-we-set-two-different-colors-for-single-value-a.html

@sbhatnagar88 have you checked out my answers below with run anywhere example? By default of value does not belong to any of the defined limit, Single Value will render it in Grey color. Hence by default NA should show up as Grey.

[jawaharas]

@sbhatnagar88
For color range to work, why can't you use integer zero (0) instead string 'NA'?

|..
| fillnull value=0 availability 
|..