Dashboards & Visualizations

Why is my single value visualization turning red instead of green when value==zero?

johnraftery
Communicator

Hi,

I have a single value visualization defined like this:

      <single>
        <title>ParNew duration as % of TPS duration</title>
        <search>
          <query>eventtype=mlc sourcetype=tps host=$host_token$ | ... | eval par_new_%_of_tps = round(total_par_new_duration_ms/total_tps_duration_ms,2)*100 | fields par_new_%_of_tps</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <option name="field">value</option>
        <option name="underLabel">Red >= 41, Orange 20-40,  Green < 20</option>
        <option name="linkView">search</option>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[20,40]</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">0</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">auto</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

The aim is to change the color based on the value according to thresholds defined in "rangeValues" [20,40]. This works for all values except 0, when the box goes red (it should be green). I guess this is because the "min" is set to 1, so if the value is below the range of 1-20, it goes to the wrong color. So should I set the min to be 0? Anyone know how?

Thanks,
John

0 Karma
1 Solution

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

View solution in original post

0 Karma

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

0 Karma
Get Updates on the Splunk Community!

Video | Welcome Back to Smartness, Pedro

Remember Splunk Community member, Pedro Borges? If you tuned into Episode 2 of our Smartness interview series, ...

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...