Dashboards & Visualizations

SingleValue not colorizing with rangemap

pde
Path Finder

I have the following view:

<form>
  <label>Booking Data</label>

  <!-- define a search that returns, in one result set,  all of the data that is 
    needed by the subsequent panels -->
  <searchTemplate>source="*rvngistats.log" host="*prod*" statsLogger.com.pegs.rvng.mdb.OTAMessageListener PAYLOAD transactionType="*" | stats count(eval(transactionType LIKE "%LSRQ")) as totalCount count(eval(transactionType LIKE "BOOKRQSS%")) as book count(eval(transactionType LIKE "BOOKRQXX%")) as cancel | eval look_book=round(totalCount/book) | eval net_book=book-cancel</searchTemplate>

 <fieldset>
      <input type="time" />
  </fieldset>

  <row>
    <single>
      <searchPostProcess>| stats max(book)| rangemap field=book default=severe low=0-500</searchPostProcess>
      <title>Gross Bookings</title>
      <option name="field">max(book)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(cancel)| rangemap field=cancel default=severe low=0-500</searchPostProcess>
      <title>Cancels</title>
      <option name="field">max(cancel)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(net_book)| rangemap field=net_book default=severe low=0-500</searchPostProcess>
      <title>Net Bookings</title>
      <option name="field">max(net_book)</option>
    </single>
  </row>

</form>

The form works as expected; the SV panels get populated with the correct numbers for book, cancel, and net_book. However, the background on the SV buttons is always blue, no matter what values are displayed. I had expected it to be green when the values are between 0 and 500, but no such luck. What have I missed?

Tags (2)
0 Karma

pde
Path Finder

Ah Hah. Stephen is correct, plus I was missing

  <option name="classField">range</option>

in the definitions.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

This is because your stats output fields called max({book,cancel,net_book}) but your rangemap command looks for the field in {book,cancel,net_book}. You can either change the field= argument to rangemap to look in the max(...) field or rename the field in stats using as {book,cancel,net_book} and change the <option name="field"> values as well.

pde
Path Finder

That makes sense, Stephen, thanks. Apparently though I've failed some basic grok here, because we don't get colorized with this either:


| stats max(book) as book | rangemap field=book default=severe low=0-500
Gross Bookings
book


| stats max(cancel)| rangemap field=max(cancel) default=severe low=0-500
Cancels
max(cancel)

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...