Dashboards & Visualizations

Is there an easy way to change the color of a non numeric 'single value' visualization?

rvoninski_splun
Splunk Employee
Splunk Employee

I am working on creating a dashboard of my home status that looks like the graphic attached. Ideally I would like to have a green background around the word 'Secure' and a red background around the word 'Open'. It seems like the single value type is designed to change colors based on numeric values. Is there an easy way to make it change based on some text or other condition?alt text

Tags (2)
1 Solution

somesoni2
Revered Legend

Look at the Splunk 6.x Dashboard Example app for different customization's available https://splunkbase.splunk.com/app/1603/

Something like this would work for your case (run anywhere sample)

<dashboard>
  <label>Custom Color</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| gentimes start=-1 | eval Result="Secure" | table Result | eval range=if(Result="Secure","low","severe")</query>
        </search>
      </single>
      <single>
        <search>
          <query>| gentimes start=-1 | eval Result="Open" | table Result | eval range=if(Result="Secure","low","severe")</query>
        </search>        
      </single>
    </panel>
  </row>
</dashboard>

View solution in original post

somesoni2
Revered Legend

Look at the Splunk 6.x Dashboard Example app for different customization's available https://splunkbase.splunk.com/app/1603/

Something like this would work for your case (run anywhere sample)

<dashboard>
  <label>Custom Color</label>
  <row>
    <panel>
      <single>
        <search>
          <query>| gentimes start=-1 | eval Result="Secure" | table Result | eval range=if(Result="Secure","low","severe")</query>
        </search>
      </single>
      <single>
        <search>
          <query>| gentimes start=-1 | eval Result="Open" | table Result | eval range=if(Result="Secure","low","severe")</query>
        </search>        
      </single>
    </panel>
  </row>
</dashboard>

rvoninski_splun
Splunk Employee
Splunk Employee

Works like a champion!! I looked over the dashbaord examples but didnt catch that snippet of code. So easy once you see how this works. Thank you again.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...