Dashboards & Visualizations

How to change value in single value visualization based on numeric and string values.

sbhatnagar88
Path Finder

HI,

How can I change color of panel based on numeric and string.

For Example-

| inputlookup host_availability.csv
| eval host=upper(host)
| join host
[| inputlookup data.csv
| search host=* Environment="*" Application="ABC" ]
| stats avg(%Availability) as availability
| eval availability=round(availability,3)
| fillnull value=NA availability
| fields availability


If there is some numeric value in availability field, we know colours can be changed based upon "colour by value" field.

Question is - If my value is "NA", i need colour to be changed to grey(showing as grayed out). How can I define this.

Thanks

Tags (1)
0 Karma

niketn
Legend

@sbhatnagar88 if you are using Single Value visualization with Block color this should be default behavior.

I have created a dummy run anywhere dashboard for you to test this with internal index. Reduce the time in Time Picker so that there are no Error in Splunk for selected time frame (like Last 15 minute), you will get null value which will show up as NA. Due to block color mode the color range will not get applied and entire single value panel will show Grey color. Please try out and confirm!

<form>
  <label>Single Value Filled by Range and NA as Grey</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTIme" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </default>
      </input>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd
| stats count as Total count(eval(log_level=="ERROR")) as ERROR
| eval Availability=Total/ERROR
| fillnull value="NA" Availability
| table Availability</query>
          <earliest>$tokTIme.earliest$</earliest>
          <latest>$tokTIme.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.00</option>
        <option name="rangeColors">["0x53a051","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[95,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gaurav_maniar
Builder

Hi

You can do it by using rangemap command and define your own color mapping.

|makeresults | eval availability="NA" | rangemap field=availability default=gray

Now set your range colors from panel options.

Please upvote and accept the answers if it works for you.

0 Karma

sbhatnagar88
Path Finder

Hi Gaurav,

Unfortunately , its not working...By Default black colour is coming and its not changing.

Thanks

0 Karma

gaurav_maniar
Builder

Hi,

Which Splunk version you are using?

Try with below XML code (if the below code doesn't work there may be issue with field values. Share your XML code, query and sample results, )
First test the XML code by changing value in makeresult query, if works fine that replace it with your query.

<row>
    <panel>
      <single>
        <search>
          <query>|makeresults | eval availability="NA" | rangemap field=availability default=gray</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="field">state</option>
        <option name="rangeColors">["0xd93f3c","0xf7bc38","0x65a637"]</option>
        <option name="rangeValues">[25,50]</option>
        <option name="showTrendIndicator">0</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
0 Karma

niketn
Legend

@gaurav_maniar as per Splunk Documentation rangemap should not be used for coloring Single Value visualization as the same will get overridden in case dashboard panel is edited. https://answers.splunk.com/answers/715473/range-map-is-not-working-properly-in-splunk-653.html

You should use UI Edit or in case of complex logic, use Simple XML JS Extension https://answers.splunk.com/answers/583539/can-we-set-two-different-colors-for-single-value-a.html

@sbhatnagar88 have you checked out my answers below with run anywhere example? By default of value does not belong to any of the defined limit, Single Value will render it in Grey color. Hence by default NA should show up as Grey.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jawaharas
Motivator

@sbhatnagar88
For color range to work, why can't you use integer zero (0) instead string 'NA'?

|..
| fillnull value=0 availability 
|..
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...