Dashboards & Visualizations

Stats to generate a single value background color AND font colour

x05311
Explorer

How to change stats to generate a single value background color AND font colour

Tags (1)
0 Karma
1 Solution

puneethgowda
Communicator

sorry i could not copy full xml code please refer below

option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]option
option name="rangeValues">[1,2]/option>

View solution in original post

0 Karma

puneethgowda
Communicator

alt text

0 Karma

puneethgowda
Communicator

sorry i could not copy full xml code please refer below

option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]option
option name="rangeValues">[1,2]/option>

0 Karma

x05311
Explorer

Thanks working for me

0 Karma

puneethgowda
Communicator

Happy Splunking

0 Karma

x05311
Explorer

sorry Unable to do , can u pls provide full code :
my splunk code is :
index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure
| stats count

0 Karma

puneethgowda
Communicator

you should add this in dashboard XML go to edit source and add this this will not work as it is you need to adjust accordingly

0 Karma

x05311
Explorer

I've added into dashboard like below but no use

   <single>
    <title>Authentication</title>
    <search>


      <query>index="index"| rex "(?:[^\t\n]*\t){16}(?P&lt;runcode&gt;[^\t]*)"|rex "(?:[^\t\n]*\t){17}(?P&lt;reasoncode&gt;[^\t]*)" | rex max_match=0 "&lt;messageString&gt;(?&lt;reasoncode&gt;[^\\&lt;\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | stats count</query>



      <sampleRatio>1</sampleRatio>
    </search>
    <option name="drilldown">all</option>
 <option name="rangeColors">["0x65a637","0xf58f39","0xd93f3c"]</option>
 <option name="rangeValues">[1,2]</option>


  </single>
  <single>
0 Karma

puneethgowda
Communicator

This is not the way to add dear

0 Karma

x05311
Explorer
 <title>Authentication</title>
 <search>


   <query>index="index"| rex "(?:[^\t\n]*\t){16}(?P&lt;runcode&gt;[^\t]*)"|rex "(?:[^\t\n]*\t){17}(?P&lt;reasoncode&gt;[^\t]*)" | rex max_match=0 "&lt;messageString&gt;(?&lt;reasoncode&gt;[^\\&lt;\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | stats count</query>



   <sampleRatio>1</sampleRatio>
 </search>


 <option name="drilldown">all</option>

["0x65a637","0xf58f39","0xd93f3c"]

[1,2]

0 Karma

puneethgowda
Communicator

see the image which i posted

0 Karma

x05311
Explorer

Thanks ..working for me

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi x05311,
you can configure your Single Value Panel to use colors for font or background using UI.
You can use different colors for different ranges of your values.
if you want to have only one color for all values (number or background) you can set the same color for every value of your results.

In other words:

  • create your search with a stats command and a single value result;
  • save it in a dashboard as Single Value Panel;
  • set Format: Using Colors (by UI);
  • set the colors of the values ranges.

Bye.
Giuseppe

0 Karma

x05311
Explorer

sorry Unable to do , can u pls provide full code :
my splunk code is :
index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure AND reason_sub_code="CAM-AAA"
| stats count

0 Karma

lguinn2
Legend

We need more information. stats cannot generate colors. In a dashboard, you can control the background color / value color for a single-value panel. If you could describe your data, what you need to calculate, and how you want to display it - then the community could probably make some good suggestions for you.

0 Karma

x05311
Explorer

index="index" | rex "(?:[^\t\n]\t){16}(?P[^\t])"|rex "(?:[^\t\n]\t){17}(?P[^\t])" | rex max_match=0 "(?[^\<\"]*)"|eval reason_sub_code=substr(reasoncode,1,7) | search runcode=Failure AND reason_sub_code="CAM-AAA"
| stats count

0 Karma

niketn
Legend

Rangemap can be used to color Single Value visualization. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap#Examples

However, Splunk recommends controlling colors by configuring ranges in visualization properties instead. https://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...