Stats to generate a single value background color AND font colour

[x05311]

How to change stats to generate a single value background color AND font colour

[puneethgowda]

[puneethgowda · Accepted solution]

sorry i could not copy full xml code please refer below

option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]option
option name="rangeValues">[1,2]/option>

[x05311]

Thanks working for me

[puneethgowda]

Happy Splunking

[x05311]

sorry Unable to do , can u pls provide full code :
my splunk code is :
index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure
| stats count

[puneethgowda]

you should add this in dashboard XML go to edit source and add this this will not work as it is you need to adjust accordingly

[x05311]

I've added into dashboard like below but no use

   <single>
    <title>Authentication</title>
    <search>


      <query>index="index"| rex "(?:[^\t\n]*\t){16}(?P&lt;runcode&gt;[^\t]*)"|rex "(?:[^\t\n]*\t){17}(?P&lt;reasoncode&gt;[^\t]*)" | rex max_match=0 "&lt;messageString&gt;(?&lt;reasoncode&gt;[^\\&lt;\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | stats count</query>



      <sampleRatio>1</sampleRatio>
    </search>
    <option name="drilldown">all</option>
 <option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]</option>
 <option name="rangeValues">[1,2]</option>


  </single>
  <single>

[puneethgowda]

This is not the way to add dear

[x05311]

 <title>Authentication</title>
 <search>


   <query>index="index"| rex "(?:[^\t\n]*\t){16}(?P&lt;runcode&gt;[^\t]*)"|rex "(?:[^\t\n]*\t){17}(?P&lt;reasoncode&gt;[^\t]*)" | rex max_match=0 "&lt;messageString&gt;(?&lt;reasoncode&gt;[^\\&lt;\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | stats count</query>



   <sampleRatio>1</sampleRatio>
 </search>


 <option name="drilldown">all</option>

["0x65a637","0xf58f39","0xd93f3c"]

[1,2]

[puneethgowda]

see the image which i posted

[x05311]

Thanks ..working for me

[gcusello]

Hi x05311,
you can configure your Single Value Panel to use colors for font or background using UI.
You can use different colors for different ranges of your values.
if you want to have only one color for all values (number or background) you can set the same color for every value of your results.

In other words:

• create your search with a stats command and a single value result;
• save it in a dashboard as Single Value Panel;
• set Format: Using Colors (by UI);
• set the colors of the values ranges.

Bye.
Giuseppe

[x05311]

sorry Unable to do , can u pls provide full code :
my splunk code is :
index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure AND reason_sub_code="CAM-AAA"
| stats count

[lguinn2]

We need more information. stats cannot generate colors. In a dashboard, you can control the background color / value color for a single-value panel. If you could describe your data, what you need to calculate, and how you want to display it - then the community could probably make some good suggestions for you.

[x05311]

index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure AND reason_sub_code="CAM-AAA"
| stats count

[niketn]

Rangemap can be used to color Single Value visualization. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap#Examples

However, Splunk recommends controlling colors by configuring ranges in visualization properties instead. https://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap...