Dashboards & Visualizations

Why is my single value visualization turning red instead of green when value==zero?

johnraftery
Communicator

Hi,

I have a single value visualization defined like this:

      <single>
        <title>ParNew duration as % of TPS duration</title>
        <search>
          <query>eventtype=mlc sourcetype=tps host=$host_token$ | ... | eval par_new_%_of_tps = round(total_par_new_duration_ms/total_tps_duration_ms,2)*100 | fields par_new_%_of_tps</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <option name="field">value</option>
        <option name="underLabel">Red >= 41, Orange 20-40,  Green < 20</option>
        <option name="linkView">search</option>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[20,40]</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">0</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">auto</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

The aim is to change the color based on the value according to thresholds defined in "rangeValues" [20,40]. This works for all values except 0, when the box goes red (it should be green). I guess this is because the "min" is set to 1, so if the value is below the range of 1-20, it goes to the wrong color. So should I set the min to be 0? Anyone know how?

Thanks,
John

0 Karma
1 Solution

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

View solution in original post

0 Karma

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...