Dashboards & Visualizations

Single value with trellis have to show color based on field value

999balaji9
New Member

Hi Team, 

Kindly help me with the below scenario.

 

As shown in the diagram my query is index=main |stats count by log_level

 

I would like to show the background color for Error is red, Warn is Amber, Info is green. The color shouldn't depend on the values. Whatever the count it does not matter. when the panels should always show red for ERROR Warn is Amber, Info is green

999balaji9_0-1620125447044.png

 

Kindly help me on the same 

 

Thanks & Regards,

Reddy

 

Labels (2)
0 Karma

TheFlash
Path Finder

TheFlash_0-1620136372147.png

you want this right ? 

Right mouse click on screen then click on inspect and and then check for the html tag where your value is, as you can see in below image there is a "id" in the div tag which is unique to my single value 

TheFlash_1-1620136734941.png

and you can also see my id="singlevalue" which is the child of div tag which have id="facet-viz_groupby_field_sourcetype_groupby_value_splunk_web_service", you will also see something similar for your panel. Since id is unique, I can use this to change the background color. Then create a .css file(for e.g. color.css) in $SPLUNK_HOME/etc/apps/<your-app-name>/appserver/static. And in that CSS file write the following code:

1. if you want background like red one, then write: 

#facet-viz_groupby_field_sourcetype_groupby_value_splunk_web_access{
background:red;
}

(here "#facet-viz_groupby_field_sourcetype_groupby_value_splunk_web_access" is the id you saw in above image"

2. if you want background like green one, then write:

#facet-viz_groupby_field_sourcetype_groupby_value_splunk_web_service>div#singlevalue{
background:green;
}

(here "div#singlevalue" is written to identify the child of "#facet-viz_groupby_field_sourcetype_groupby_value_splunk_web_service" )

If this help you, give an upvote 
Thank you

 

 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!