Dashboards & Visualizations

How to edit my dashboard XML to get a single value string to change color based on value ranges?

splunker1981
Path Finder

Hello Splunkers,

Hoping someone can help or point me in the right direction. I am trying to color code my single value string based on value ranges they fall under. Here is my XML. What I am trying to do is make the string RUNNING green and DOWN red. What am I missing here? I'm on version 6.4. Thanks for all the help in advance.

          <query>|stats count| fields - count | eval diff=2000|  eval status=case(diff<=1500, "RUNNING", diff >1501, "DOWN") |rangemap field=status low=0-1500 severe=1501-9999</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="classField">range</option>
        <option name="field">status</option>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x555555"]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
0 Karma
1 Solution

somesoni2
Revered Legend

Try this search

|stats count| fields - count | eval diff=2000|  eval status=case(diff<=1500, "RUNNING", diff >1501, "DOWN") |rangemap field=diff low=0-1500 severe=1501-9999 |table status range

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this search

|stats count| fields - count | eval diff=2000|  eval status=case(diff<=1500, "RUNNING", diff >1501, "DOWN") |rangemap field=diff low=0-1500 severe=1501-9999 |table status range
0 Karma

splunker1981
Path Finder

Arggg, so the field has to be the value and then a table command is needed. Thanks for the help, somesoni2 this got things working.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...