Dashboards & Visualizations

Stats to generate a single value background color AND font colour

x05311
Explorer

How to change stats to generate a single value background color AND font colour

Tags (1)
0 Karma
1 Solution

puneethgowda
Communicator

sorry i could not copy full xml code please refer below

option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]option
option name="rangeValues">[1,2]/option>

View solution in original post

0 Karma

puneethgowda
Communicator

alt text

0 Karma

puneethgowda
Communicator

sorry i could not copy full xml code please refer below

option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]option
option name="rangeValues">[1,2]/option>

0 Karma

x05311
Explorer

Thanks working for me

0 Karma

puneethgowda
Communicator

Happy Splunking

0 Karma

x05311
Explorer

sorry Unable to do , can u pls provide full code :
my splunk code is :
index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure
| stats count

0 Karma

puneethgowda
Communicator

you should add this in dashboard XML go to edit source and add this this will not work as it is you need to adjust accordingly

0 Karma

x05311
Explorer

I've added into dashboard like below but no use

   <single>
    <title>Authentication</title>
    <search>


      <query>index="index"| rex "(?:[^\t\n]*\t){16}(?P&lt;runcode&gt;[^\t]*)"|rex "(?:[^\t\n]*\t){17}(?P&lt;reasoncode&gt;[^\t]*)" | rex max_match=0 "&lt;messageString&gt;(?&lt;reasoncode&gt;[^\\&lt;\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | stats count</query>



      <sampleRatio>1</sampleRatio>
    </search>
    <option name="drilldown">all</option>
 <option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]</option>
 <option name="rangeValues">[1,2]</option>


  </single>
  <single>
0 Karma

puneethgowda
Communicator

This is not the way to add dear

0 Karma

x05311
Explorer
 <title>Authentication</title>
 <search>


   <query>index="index"| rex "(?:[^\t\n]*\t){16}(?P&lt;runcode&gt;[^\t]*)"|rex "(?:[^\t\n]*\t){17}(?P&lt;reasoncode&gt;[^\t]*)" | rex max_match=0 "&lt;messageString&gt;(?&lt;reasoncode&gt;[^\\&lt;\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | stats count</query>



   <sampleRatio>1</sampleRatio>
 </search>


 <option name="drilldown">all</option>

["0x65a637","0xf58f39","0xd93f3c"]

[1,2]

0 Karma

puneethgowda
Communicator

see the image which i posted

0 Karma

x05311
Explorer

Thanks ..working for me

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi x05311,
you can configure your Single Value Panel to use colors for font or background using UI.
You can use different colors for different ranges of your values.
if you want to have only one color for all values (number or background) you can set the same color for every value of your results.

In other words:

  • create your search with a stats command and a single value result;
  • save it in a dashboard as Single Value Panel;
  • set Format: Using Colors (by UI);
  • set the colors of the values ranges.

Bye.
Giuseppe

0 Karma

x05311
Explorer

sorry Unable to do , can u pls provide full code :
my splunk code is :
index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure AND reason_sub_code="CAM-AAA"
| stats count

0 Karma

lguinn2
Legend

We need more information. stats cannot generate colors. In a dashboard, you can control the background color / value color for a single-value panel. If you could describe your data, what you need to calculate, and how you want to display it - then the community could probably make some good suggestions for you.

0 Karma

x05311
Explorer

index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure AND reason_sub_code="CAM-AAA"
| stats count

0 Karma

niketn
Legend

Rangemap can be used to color Single Value visualization. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap#Examples

However, Splunk recommends controlling colors by configuring ranges in visualization properties instead. https://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...