how to display a range in color (Good or Fault)

[sjansma]

As result i would have a green "Good" or a red "Fault"

<title>Schoning bestanden</title>
<searchString>index=tm sourcetype="tm-cleanup:log" "(cleanup.sh) - In totaal" | rex field=_raw "exitstatus=(?&lt;bericht&gt;.*)" | head 1 | eval n=substr(bericht,1,1) | eval code=case(n=0,"Goed",0=0,"Fout") | stats count by code | eval codecheck = if (code=="Goed", 0, 1) | rangemap field=codecheck green=0-0 red=1-100 default=green</searchString>
<earliestTime>-1d@d</earliestTime>
<latestTime>@d</latestTime>
<option name="classField">range</option>
<option name="field">code</option>
    <option name="linkView">search</option>
    <option name="drilldown">none</option>
  </single>

[lguinn2 · Accepted solution]

This is fine, but Splunk does not know how to colorize rangemap fields named "red" or "green". The default color mapping is

low = green
guarded = blue
elevated = yellow
high = orange
severe =red

because the default Splunk CSS has already mapped these categories. So use "low" for green and "severe" for red in your rangemap command.

If you want to define your own categories, you can create your own CSS. You might want to look at this answer How do I change the color mappings in rangemap

[SanthoshSreshta]

How to add that low=green for our query. please can anyone share me..I am very new to the splunk. I want to change colors for geostats map.

[vganjare]

Following is sample usage:

| gentimes start=1 end=2 | eval count=9 | fields count | rangemap field=count low=0-2 guarded=3-4 elevated=5-6 high=7-8 severe=9-10

execute this search and use the visualization as single value pannel. Change the value of count from 1 tp 9 for validating the color difference.

Thanks!!