Dashboards & Visualizations

single value not changing colour

kris99
New Member

following not displaying colour within the form.

If search finds events between 3012 - 3054, display Warning in Yellow (i.e elevated).

If I search and view as elevated, its displays the count of events in Yellow. But this is not working in form.

HV-test

<single>
  <title>HV Err</title>
  <searchString>index =xxx  Type!=Information  (EventCode&gt;="3012" AND EventCode&lt;="3054") | stats count | appendpipe [ stats count | eval Status="No Errors" | where count==0 ] | eval Status=if(count==0,"No Errors","Warning") | eval range = if(Status=="No Errors","low","elevated")</searchString>
  <earliestTime>-7d@h</earliestTime>
  <latestTime>now</latestTime>
  <option name="list.wrap">1</option>
  <option name="classField">range</option>
  <option name="field">Status</option>
</single>
0 Karma

paulmarticsi
Explorer

Get the Status Indicator app - it will allow you to do single value text with colors and icons. There are examples in the Dashboard Examples app by Splunk.
,A better way to go is to get the 'Status Indicator' app. Think of it as a super-powered single value visualization. I did the same thing with it and it includes the capacity to add an icon based on output.

0 Karma

stephanefotso
Motivator

It should work. I made a code similar to yours, with forms inputs, and that works very well. Take a look at it.

<form>
  <label>single_value_changing_color</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="action" searchWhenChanged="true">
      <label>Choose one action</label>
      <choice value="*">All</choice>
      <populatingSearch fieldForLabel="action" fieldForValue="action">index=_audit|stats count by action|sort action</populatingSearch>
      <default>change_own_password</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>HV Err</title>
        <searchString>index=_audit action=$action$ | stats count by   user | appendpipe [stats sum(count) as count  | eval Status = "LESS THANT 20"|where count&lt;20]|sort action| eval Status=if(count&lt;20,"LESS THANT 20","MORE THAN 20") | eval range = if(Status=="LESS THANT 20","low","elevated")</searchString>
        <earliestTime>$time.earliest$</earliestTime>
        <latestTime>$time.latest$</latestTime>
        <option name="list.wrap">1</option>
        <option name="classField">range</option>
        <option name="field">Status</option>
        <option name="linkView">search</option>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Taking that panel XML works for me, the text is displayed as green if the count is zero and yellow otherwise.

Are there any CSS messages logged in your browser's console?
Does the app of that dashboard contain any CSS customization?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...