How to set colors for non-numeric values in single value visualizations?

[lsaad]

Dears,

I am having difficulty setting set colors for non-numerical values.

Has someone gone through this problem?

<dashboard stylesheet="table_decorations.css" script="table_icons_rangemap.js">
  <label>Main Dashboard</label>
  <row>
    <panel>
      <single>
        <title>Alertas de Sistema</title>
        <search>
          <query>sourcetype=syserrordapp | stats max(Level) count | fillnull value=0 max(Level)  | table max(Level), count | replace 0 with "GREEN COLOR", 1 with "YELLOW COLOR", 2 with "RED COLOR</query>
          <earliest>rt-5m</earliest>
          <latest>rt</latest>
        </search>
        <option name="classField">range</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="drilldown">all</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Alertas de Rede</title>
        <search>
          <query>sourcetype=memoryerrordapp | stats max(Level) count | fillnull value=0 max(Level) | table max(Level), count | replace 0 with "GREEN COLOR", 1 with "YELLOW COLOR", 2 with "RED COLOR</query>
          <earliest>rt-5m</earliest>
          <latest>rtnow</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c","0x555555","0x555555"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">auto</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Alertas de Desktop e Servidores</title>
        <search>
          <query>sourcetype=desktopsdapp | stats max(Level) count | fillnull value=0 max(Level) | table max(Level), count | replace 0 with "GREEN COLOR", 1 with "YELLOW COLOR", 2 with "RED COLOR"</query>
          <earliest>rt-5m</earliest>
          <latest>rt</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">auto</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

[dfigurello · Accepted solution]

Hi lsaad,

You could try this:

<dashboard>
  <label>teste</label>
  <row>
    <panel>
      <single>
        <search>
          <query>sourcetype=memoryerrordapp | stats count as test  | rangemap field=test elevated=0-199 severe=200-400 default=low | replace 0 with "text here"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="classField">range</option>
        <option name="field">teste</option>
        <option name="useColors">0</option>
      </single>
    </panel>
  </row>
</dashboard>

[lsaad]

Perfect dfigurello.

Thanks.

[jkat54]

Check out my answer over here (not the accepted answer, but the upvoted answer):
https://answers.splunk.com/answers/66734/bar-chart-color.html#answer-66769

Here's a new link to the chart config ref:
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/ChartConfigurationReference

charting.fieldColors is what you're looking for, and I gave an example in the answer linked above.