Dashboards & Visualizations

SingleValue not colorizing with rangemap

pde
Path Finder

I have the following view:

<form>
  <label>Booking Data</label>

  <!-- define a search that returns, in one result set,  all of the data that is 
    needed by the subsequent panels -->
  <searchTemplate>source="*rvngistats.log" host="*prod*" statsLogger.com.pegs.rvng.mdb.OTAMessageListener PAYLOAD transactionType="*" | stats count(eval(transactionType LIKE "%LSRQ")) as totalCount count(eval(transactionType LIKE "BOOKRQSS%")) as book count(eval(transactionType LIKE "BOOKRQXX%")) as cancel | eval look_book=round(totalCount/book) | eval net_book=book-cancel</searchTemplate>

 <fieldset>
      <input type="time" />
  </fieldset>

  <row>
    <single>
      <searchPostProcess>| stats max(book)| rangemap field=book default=severe low=0-500</searchPostProcess>
      <title>Gross Bookings</title>
      <option name="field">max(book)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(cancel)| rangemap field=cancel default=severe low=0-500</searchPostProcess>
      <title>Cancels</title>
      <option name="field">max(cancel)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(net_book)| rangemap field=net_book default=severe low=0-500</searchPostProcess>
      <title>Net Bookings</title>
      <option name="field">max(net_book)</option>
    </single>
  </row>

</form>

The form works as expected; the SV panels get populated with the correct numbers for book, cancel, and net_book. However, the background on the SV buttons is always blue, no matter what values are displayed. I had expected it to be green when the values are between 0 and 500, but no such luck. What have I missed?

Tags (2)
0 Karma

pde
Path Finder

Ah Hah. Stephen is correct, plus I was missing

  <option name="classField">range</option>

in the definitions.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

This is because your stats output fields called max({book,cancel,net_book}) but your rangemap command looks for the field in {book,cancel,net_book}. You can either change the field= argument to rangemap to look in the max(...) field or rename the field in stats using as {book,cancel,net_book} and change the <option name="field"> values as well.

pde
Path Finder

That makes sense, Stephen, thanks. Apparently though I've failed some basic grok here, because we don't get colorized with this either:


| stats max(book) as book | rangemap field=book default=severe low=0-500
Gross Bookings
book


| stats max(cancel)| rangemap field=max(cancel) default=severe low=0-500
Cancels
max(cancel)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...