Dashboards & Visualizations

SingleValue not colorizing with rangemap

pde
Path Finder

I have the following view:

<form>
  <label>Booking Data</label>

  <!-- define a search that returns, in one result set,  all of the data that is 
    needed by the subsequent panels -->
  <searchTemplate>source="*rvngistats.log" host="*prod*" statsLogger.com.pegs.rvng.mdb.OTAMessageListener PAYLOAD transactionType="*" | stats count(eval(transactionType LIKE "%LSRQ")) as totalCount count(eval(transactionType LIKE "BOOKRQSS%")) as book count(eval(transactionType LIKE "BOOKRQXX%")) as cancel | eval look_book=round(totalCount/book) | eval net_book=book-cancel</searchTemplate>

 <fieldset>
      <input type="time" />
  </fieldset>

  <row>
    <single>
      <searchPostProcess>| stats max(book)| rangemap field=book default=severe low=0-500</searchPostProcess>
      <title>Gross Bookings</title>
      <option name="field">max(book)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(cancel)| rangemap field=cancel default=severe low=0-500</searchPostProcess>
      <title>Cancels</title>
      <option name="field">max(cancel)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(net_book)| rangemap field=net_book default=severe low=0-500</searchPostProcess>
      <title>Net Bookings</title>
      <option name="field">max(net_book)</option>
    </single>
  </row>

</form>

The form works as expected; the SV panels get populated with the correct numbers for book, cancel, and net_book. However, the background on the SV buttons is always blue, no matter what values are displayed. I had expected it to be green when the values are between 0 and 500, but no such luck. What have I missed?

Tags (2)
0 Karma

pde
Path Finder

Ah Hah. Stephen is correct, plus I was missing

  <option name="classField">range</option>

in the definitions.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

This is because your stats output fields called max({book,cancel,net_book}) but your rangemap command looks for the field in {book,cancel,net_book}. You can either change the field= argument to rangemap to look in the max(...) field or rename the field in stats using as {book,cancel,net_book} and change the <option name="field"> values as well.

pde
Path Finder

That makes sense, Stephen, thanks. Apparently though I've failed some basic grok here, because we don't get colorized with this either:


| stats max(book) as book | rangemap field=book default=severe low=0-500
Gross Bookings
book


| stats max(cancel)| rangemap field=max(cancel) default=severe low=0-500
Cancels
max(cancel)

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...