- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Single Value visualization - Display text with col...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a single value chart where I will be showing if Node is UP or DOWN. I want to show the color green with text display as UP and red color with text value as DOWN.
However single value visualization needs numeric value to show the color, how do I change the display to text - UP or DOWN.
Below code display number 1 or 0 with green/red color but I want to display UP/DOWN. What code changes I need to do ?
index=datagov source=node_log
| eval service_up = if(_raw like "%successfully%",1,0)
| stats values(service_up) as Availibilty
Thanks in advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@purushot1234 refer to one of my older answer with couple of options: https://answers.splunk.com/answers/595910/how-to-build-a-dashboard-with-single-panel-value-b.html
You can also use <html> panel for Single Value Color based on text.
In case you are interested in Drilldown from Status Indicator or html panel, refer to my older answer: https://answers.splunk.com/answers/746858/do-trellis-also-have-drilldown-capability.html
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@purushot1234 refer to one of my older answer with couple of options: https://answers.splunk.com/answers/595910/how-to-build-a-dashboard-with-single-panel-value-b.html
You can also use <html> panel for Single Value Color based on text.
In case you are interested in Drilldown from Status Indicator or html panel, refer to my older answer: https://answers.splunk.com/answers/746858/do-trellis-also-have-drilldown-capability.html
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you but I didn't understand it clearly as I am new to Splunk. Could you please help me in my search ? Below is the search I am using in a report which display 1 or 0 with Green/Red color. But I want display as UP or DOWN. What extra code I need to add below ? Thank you
index=datagov source=node_log
| eval service_up = if(_raw like "%successfully%",1,0)
| stats values(service_up) as Availability by node
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=datagov source=node_log
| eval range = if(searchmatch("successfully"),"severe","low")
| eval Availability = if(range="severe","UP","Down")
| stats values(range) as range by node Availability
options:
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="field">Availability</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637,"0xd93f3c"]</option>
<option name="rangeValues">[0]</option>
<option name="trellis.enabled">1</option>
<option name="trellis.splitBy">node</option>
<option name="useColors">0</option>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. But I am getting an error as Error in 'stats' command: The argument 'vvalues(range)' is invalid.
I wan to create this as report first and then add into dashboard. Is this possible or I need to directly add this code in dashboard ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry, here is typo. I fix it.
Is this possible or I need to directly add this code in dashboard
yes
you can do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much. I am getting the text now with desired color. But I want display as a box with red color and text inside with white color. So when I chose use color yes and chose color mode format option to show box, it shows black color box. How do I show red or green box with text (white color) inside
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you should modify source not GUI
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. So what options I need to add in source for this ? Shall I create the report as above and then add additional options to show it in box with color and white text ? If you could please let me know those options that I need to add in source then that would be great. Sorry for too many queries.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
<row>
<panel>
<single>
<title>Option 2 - Using Single Value</title>
<search>
<query>| makeresults
| eval status=mvindex(split("UP DOWN"," "),(random() % 2))
| eval range=if(status="DOWN" ,"severe", "low")
| stats count by status range</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="field">status</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637,"0xd93f3c"]</option>
<option name="rangeValues">[0]</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
this is sample.
reference:https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
