have different fields for foreground text and background color fill for Single Value panel in 6.3

[ishaanshekhar]

Hi,
I want the background fill (newly introduced in 6.3 Single Value) of a Single Value panel be based on value of a column called "range". And, its label be based on value of another column called "Share_Name".

Is it possible in 6.3?

... <Initial Search> ... |head 1|eval range=case(share_value>=90,"severe", availability>=80,"elevated",1=1,"low")|eval Share_Name="myShare"|table Header range

Right now, it shows myShare as the foreground text but the background is coming as black color. I want the background color fill be based on the range column value, but the foreground text as "myShare" in above case.

Thanks for your help!
Ishaan

[gcato · Accepted solution]

Hi ishaanshekhar,

Having a look at the Splunk 6.3 upgrade guide it indicates that rangemap will not work anymore (basically, what your "eval range=..." command is doing). You now must use the UI to set single value colors. You can find the detials here: http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/Aboutupgradingto6.3READTHISFIRST

The Splunk Web visualizations editor changes take precedence over existing 'rangemap' configurations for single-value visualizations. If you use the rangemap search command to define ranges and colors for single-value visualizations on dashboards, use the Format editor instead when you upgrade. Changes that you make with the Format editor to these visualizations override the rangemap configurations. Going forward, generate new single value visualizations by using a query that does not contain the rangemap command, and then use the Format editor to configure ranges, colors, or any additional settings.

Any changes that you make with the editor to single-value visualizations that were generated with = rangemap override edits that you make to the range map command. Additionally, while the editor attempts to preserve the existing configuration, it no longer recognizes rangemap as a valid command to generate these types of visualizations.

However, there is a workaround; you can use html and css inside your simple xml dashboard to get a similar result as earlier Splunk version. Install the latest Splunk 6.x Dashboard Examples app (https://splunkbase.splunk.com/app/1603/) and have a look at Custom Visualization -> Custom Decorations, which provides a good example of what I mean.

Hope this helps.