Single Value: Trellis View - how do I make a color change based on string values?

[cchimento]

Hello Ninjas - I am not sure if I am having a brain fart or if I am just not grasping this. Seeking some help, please. I have searched for a good few hours now and have read several of the docs.

I have a simple index populated with REST API calls that return a single word. "alive" or "dead" as the field "state" Splunk ver 7.0.3

I am trying to build a dashboard panel that will sit on a KPI dashboard. We have a rather vanilla system, so there are no apps that would probably do this for me. The result I want for each host is a single value. The trellis view is appealing because I wouldn't have to go through using a base search (but maybe i have to) and then create multiple single values.

So a Single Value; value displayed is the "state" and the color should be representative of the state, but I see the ranges must be numerical, so I eval'd a numerical value field based on the state value called "state_sev".

The code snippet below returns the "state" but does not change colors. If I change the <option name="field"> to be "state_sev" It will display the numerical value and the correct color. So I am not understanding what I am missing to make this change color while displaying the text state. The color ranges are set in the GUI.

I tried using the rangemap function and I couldn't get it to do much different. I am fearful this might be due to trellis view. Not sure. I probably don't need all those options.

Any help would be appreciated! Thank you.

  <row>
    <panel>
      <title>t6</title>
      <single>
        <search>
          <query>index=pdf_http host=r*
|eval state=_raw
|eval state_sev=case(state="alive", 1, state="dead", 5)
|stats last(state_sev) as state_sev last(state) as state by host
</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="field">state</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
        <option name="rangeValues">[5]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">0</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">host</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>

[mstjohn_splunk]

hi @cchimento,

Did either of the answers below solve your problem? If so, please resolve this post by approving one of them. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂

[cchimento]

Sorry was out of the office. I need some time to evaluate. Thanks...

[niketn · Accepted solution]

@cchimento see if one of my older answers suits your needs. It has the code for a run anywhere dashboard with Trellis and Status Indicator with data similar to yours.

https://answers.splunk.com/answers/670058/how-can-i-get-colors-into-trellis-for-values-that.html

[HiroshiSatoh]

Please refer to this answer.

https://answers.splunk.com/answers/443784/change-background-of-single-value-based-on-its-tex.html