Using a second field to color a Single Value in Dashboard Studio

[rfolkert]

As the title suggests I have a scenario where I have two fields for a single value panel, the first is a number I want to display, but the second field I want to use to color the visualization.  the color field is a threshold so if i am under threshold green over threshold red and it is returned as a simple boolean 0-1

my basic stats output looks like this, two values, the first is my number displayed, the 2nd my threshold I want to color off of.

| stats values(PercentChange) as PercentChange latest(threshold) as threshold

the question is how do I tell dashboard studio to color off of the secondary field instead of the field defined as my display value?

[rfolkert]

this was perfect, thank you!

[livehybrid · Accepted solution]

Hi @rfolkert 

Yes, you can use the following in the options{} of your visualisation:

        "backgroundColor": "> primary | seriesByName('color') | lastPoint()"

 You can use your own thresholding and logic to determine the "color" field which should render a HTML colour code (such as #00ff00) in this example:

*OR* if you want to use the built-in colour editing capability in Dashboard Studio then set it up as you normally would under "Color and Style" options for your viz, then once done go to the source code section and update to the following:

        "backgroundColor": "> primary | seriesByName('threshold') | lastPoint() | rangeValue(backgroundColorEditorConfig)"

Note, in this example I am using backgroundColor but you can update this to majorColor or whatever other color styling type you wish to use.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[chenfan]

Hi @livehybrid I've also faced a similar problem. I want to specify the color corresponding to the field value in the map view, but the modification I made doesn't take effect. Could you please help me check it?

{
"type": "splunk.map",
"options": {
"center": [
-3.337953961431438,
79.98046874997863
],
"zoom": 2,
"showBaseLayer": true,
"layers": [
{
"type": "bubble",
"latitude": "> primary | seriesByName('latitude')",
"longitude": "> primary | seriesByName('longitude')",
"bubbleSize": "> primary | frameWithoutSeriesNames('_geo_bounds_east', '_geo_bounds_west', '_geo_bounds_north', '_geo_bounds_south', 'latitude', 'longitude') | frameBySeriesTypes('number')",
"dataColors": " > primary | seriesByName('status') | matchValue('colorMatchConfig')"
}
]
},
"dataSources": {
"primary": "ds_PHhx1Fxi"
},
"context": {
"colorMatchConfig":
[
{
"match": "high",
"value": "#FF0000"
},
{
"match": "low",
"value": "#00FF00"
},
{
"match": "critical",
"value": "#0000FF"
}
]
},
"containerOptions": {},
"showProgressBar": false,
"showLastUpdated": false
}