Modify Map Colors In Dashboard Studio

[chenfan]

Hello Splunkers,

I've been having issues with Dashboard Studio lately that have been bothering me. I'd really appreciate any advice. I want to assign different colors to data based on different field values—green for "normal", yellow for "warning", and red for "critical". I've tried the following configurations, but none of them have worked.

{ "type": "splunk.map", "options": { "center": [ 34.266, 108.945 ], "zoom": 2.3155822324586683, "layers": [ { "seriesColors": [ "#00FF00", "#FFFF00", "#FF0000", "bubbleSize": "> primary | frameBySeriesNames('normal','warning','critical')" } ] }, "dataSources": { "primary": "ds_PHhx1Fxi" }, "context": {}, "showProgressBar": false, "showLastUpdated": false }

[livehybrid]

Hi @chenfan 

Since when you're missing a field it throws out the colouring, just make sure you always have the fields in the order you expect - the easiest way to do this is to add a table command to then end of your search:

| table normal warning critical *

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[tscroggins]

Hi @chenfan,

You've used the correct syntax for bubbleSize and seriesColor to select a data frame by series names and match the index of each series name to its corresponding color. Assuming "normal" is the dominant status, the screenshot looks correct.

Which part isn't working?

As an aside, Splunk's legacy default RGB values for red, yellow/amber, and green are #cba700, #d41f1f, and #118832, respectively.

[chenfan]

Hi @tscroggins Thankyou for your reply! When my data only includes "normal" and "critical" statuses, the color assigned to "critical" is yellow——and that’s not what I want.

[tscroggins]

Hi @chenfan,

I can't reproduce the issue using your layers configuration in Splunk Enterprise 10.0. Which version of Splunk are you using? Can you post a redacted version of your search?

You could try appending an eval after geostats to insert zero values when a field is missing, null, or empty:

| geostats count by status ``` latfield=lat longfield=lon ```
| eval normal=coalesce(tonumber(trim(normal)), 0), warning=coalesce(tonumber(trim(warning)), 0), critical=coalesce(tonumber(trim(critical)), 0)

 You can vary the eval command to fit whatever validation logic you prefer, e.g.:

| eval normal=if(isnull(nullif(normal, "")) OR NOT isint(normal), 0, normal), warning=if(isnull(nullif(warning, "")) OR NOT isint(warning), 0, warning), critical=if(isnull(nullif(critical, "")) OR NOT isint(critical), 0, critical)

[chenfan]

HI @livehybrid

Can you give me some suggestion? Thankyou!