Dashboards & Visualizations

SingleValue not colorizing with rangemap

pde
Path Finder

I have the following view:

<form>
  <label>Booking Data</label>

  <!-- define a search that returns, in one result set,  all of the data that is 
    needed by the subsequent panels -->
  <searchTemplate>source="*rvngistats.log" host="*prod*" statsLogger.com.pegs.rvng.mdb.OTAMessageListener PAYLOAD transactionType="*" | stats count(eval(transactionType LIKE "%LSRQ")) as totalCount count(eval(transactionType LIKE "BOOKRQSS%")) as book count(eval(transactionType LIKE "BOOKRQXX%")) as cancel | eval look_book=round(totalCount/book) | eval net_book=book-cancel</searchTemplate>

 <fieldset>
      <input type="time" />
  </fieldset>

  <row>
    <single>
      <searchPostProcess>| stats max(book)| rangemap field=book default=severe low=0-500</searchPostProcess>
      <title>Gross Bookings</title>
      <option name="field">max(book)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(cancel)| rangemap field=cancel default=severe low=0-500</searchPostProcess>
      <title>Cancels</title>
      <option name="field">max(cancel)</option>
    </single>
   <single>
      <searchPostProcess>| stats max(net_book)| rangemap field=net_book default=severe low=0-500</searchPostProcess>
      <title>Net Bookings</title>
      <option name="field">max(net_book)</option>
    </single>
  </row>

</form>

The form works as expected; the SV panels get populated with the correct numbers for book, cancel, and net_book. However, the background on the SV buttons is always blue, no matter what values are displayed. I had expected it to be green when the values are between 0 and 500, but no such luck. What have I missed?

Tags (2)
0 Karma

pde
Path Finder

Ah Hah. Stephen is correct, plus I was missing

  <option name="classField">range</option>

in the definitions.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

This is because your stats output fields called max({book,cancel,net_book}) but your rangemap command looks for the field in {book,cancel,net_book}. You can either change the field= argument to rangemap to look in the max(...) field or rename the field in stats using as {book,cancel,net_book} and change the <option name="field"> values as well.

pde
Path Finder

That makes sense, Stephen, thanks. Apparently though I've failed some basic grok here, because we don't get colorized with this either:


| stats max(book) as book | rangemap field=book default=severe low=0-500
Gross Bookings
book


| stats max(cancel)| rangemap field=max(cancel) default=severe low=0-500
Cancels
max(cancel)

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...