Dashboards & Visualizations

how we can colour the text as green for status as running and red for stopped for single value viz in dashboard studio

Ayushi-Sriva
New Member

how we can colour the text as green for status as running and red for stopped for single value visualization in dashboard studio splunk.

My Code is below :-

"ds_B6p8HEE0": {
            "type": "ds.chain",
            "options": {
                "enableSmartSources": true,
                "extend": "ds_JRxFx0K2",
                "query": "| eval status = if(OPEN_MODE=\"READ WRITE\",\"running\",\"stopped\") | stats latest(status)"
            },
            "name": "oracle status"
Labels (1)
0 Karma

renjith_nair
Legend

@Ayushi-Sriva ,

You can use the dynamic formatting, please refer here 

https://docs.splunk.com/Documentation/Splunk/9.2.0/DashStudio/chartsSV#Add_emphasis_to_a_returned_va...

Please find a run anywhere example 

You can change the status in the drop down and will be reflected in the search by using token. Based on the status, the color changes

{
    "visualizations": {
        "viz_NJsTjQl4": {
            "type": "splunk.singlevalue",
            "options": {
                "majorColor": "> majorValue | matchValue(majorColorEditorConfig)"
            },
            "dataSources": {
                "primary": "ds_275I8YNY"
            },
            "context": {
                "majorColorEditorConfig": [
                    {
                        "match": "Running",
                        "value": "#118832"
                    },
                    {
                        "match": "Stopped",
                        "value": "#d41f1f"
                    }
                ]
            }
        }
    },
    "dataSources": {
        "ds_275I8YNY": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| eval value=\"$status$\""
            },
            "name": "Search_1"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        },
        "input_BHJAbWl2": {
            "options": {
                "items": [
                    {
                        "label": "Running",
                        "value": "Running"
                    },
                    {
                        "label": "Stopped",
                        "value": "Stopped"
                    }
                ],
                "token": "status",
                "selectFirstSearchResult": true
            },
            "title": "Status",
            "type": "input.dropdown"
        }
    },
    "layout": {
        "type": "grid",
        "options": {
            "width": 1440,
            "height": 960
        },
        "structure": [
            {
                "item": "viz_NJsTjQl4",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 1440,
                    "h": 400
                }
            }
        ],
        "globalInputs": [
            "input_global_trp",
            "input_BHJAbWl2"
        ]
    },
    "description": "",
    "title": "single_panel_studio"
}

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Ayushi-Sriva
New Member

This is ok, but not helping me out as I do not want the dropdown as status as mentioned below. Even I applied below changes in my code but the color for stopped and running did not change.  below is my code after a change but no color change happened, Please help me here asap.

"viz_itT7cfIB": {
            "type": "splunk.singlevalue",
            "dataSources": {
                "primary": "ds_B6p8HEE0"
            },
            "title": "status",
            "options": {
                "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)",
                "backgroundColor": "transparent",
                "trendColor": "transparent"
            },
            "context": {
                "majorColorEditorConfig": [
                    {
                        "match": "Running",
                        "value": "#118832"
                    },
                    {
                        "match": "Stopped",
                        "value": "#d41f1f"
                    }
                ]
            }
        },
 
        "ds_B6p8HEE0": {
            "type": "ds.chain",
            "options": {
                "enableSmartSources": true,
                "extend": "ds_JRxFx0K2",
                "query": "| eval status = if(OPEN_MODE=\"READ WRITE\",\"Running\",\"Stopped\") | stats latest(status)"
            },
            "name": "oracle status"
        },
0 Karma

Ayushi-Sriva
New Member

This solution is not helping us please provide some good solution so that i can change the colour in the single value itself as I am not using the dropdown as status . Even I applied above changes in my code but the color for stopped and running did not change.  above is my code after a change but no color change happened, Please help me here asap.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...