Dashboards & Visualizations

Why is my single value visualization turning red instead of green when value==zero?

johnraftery
Communicator

Hi,

I have a single value visualization defined like this:

      <single>
        <title>ParNew duration as % of TPS duration</title>
        <search>
          <query>eventtype=mlc sourcetype=tps host=$host_token$ | ... | eval par_new_%_of_tps = round(total_par_new_duration_ms/total_tps_duration_ms,2)*100 | fields par_new_%_of_tps</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <option name="field">value</option>
        <option name="underLabel">Red >= 41, Orange 20-40,  Green < 20</option>
        <option name="linkView">search</option>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[20,40]</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">0</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">auto</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

The aim is to change the color based on the value according to thresholds defined in "rangeValues" [20,40]. This works for all values except 0, when the box goes red (it should be green). I guess this is because the "min" is set to 1, so if the value is below the range of 1-20, it goes to the wrong color. So should I set the min to be 0? Anyone know how?

Thanks,
John

0 Karma
1 Solution

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

View solution in original post

0 Karma

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...