Dashboards & Visualizations

Why is my single value visualization turning red instead of green when value==zero?

johnraftery
Communicator

Hi,

I have a single value visualization defined like this:

      <single>
        <title>ParNew duration as % of TPS duration</title>
        <search>
          <query>eventtype=mlc sourcetype=tps host=$host_token$ | ... | eval par_new_%_of_tps = round(total_par_new_duration_ms/total_tps_duration_ms,2)*100 | fields par_new_%_of_tps</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <option name="field">value</option>
        <option name="underLabel">Red >= 41, Orange 20-40,  Green < 20</option>
        <option name="linkView">search</option>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[20,40]</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">0</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">auto</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

The aim is to change the color based on the value according to thresholds defined in "rangeValues" [20,40]. This works for all values except 0, when the box goes red (it should be green). I guess this is because the "min" is set to 1, so if the value is below the range of 1-20, it goes to the wrong color. So should I set the min to be 0? Anyone know how?

Thanks,
John

0 Karma
1 Solution

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

View solution in original post

0 Karma

johnraftery
Communicator

Ok, figured it out - my query was returning a null value. For some reason the visualization translates null into a "0", but gives it a red colour.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...