single value not changing colour

[kris99]

following not displaying colour within the form.

If search finds events between 3012 - 3054, display Warning in Yellow (i.e elevated).

If I search and view as elevated, its displays the count of events in Yellow. But this is not working in form.

HV-test

<single>
  <title>HV Err</title>
  <searchString>index =xxx  Type!=Information  (EventCode&gt;="3012" AND EventCode&lt;="3054") | stats count | appendpipe [ stats count | eval Status="No Errors" | where count==0 ] | eval Status=if(count==0,"No Errors","Warning") | eval range = if(Status=="No Errors","low","elevated")</searchString>
  <earliestTime>-7d@h</earliestTime>
  <latestTime>now</latestTime>
  <option name="list.wrap">1</option>
  <option name="classField">range</option>
  <option name="field">Status</option>
</single>

[paulmarticsi]

Get the Status Indicator app - it will allow you to do single value text with colors and icons. There are examples in the Dashboard Examples app by Splunk.
,A better way to go is to get the 'Status Indicator' app. Think of it as a super-powered single value visualization. I did the same thing with it and it includes the capacity to add an icon based on output.

[stephanefotso]

It should work. I made a code similar to yours, with forms inputs, and that works very well. Take a look at it.

<form>
  <label>single_value_changing_color</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="action" searchWhenChanged="true">
      <label>Choose one action</label>
      <choice value="*">All</choice>
      <populatingSearch fieldForLabel="action" fieldForValue="action">index=_audit|stats count by action|sort action</populatingSearch>
      <default>change_own_password</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>HV Err</title>
        <searchString>index=_audit action=$action$ | stats count by   user | appendpipe [stats sum(count) as count  | eval Status = "LESS THANT 20"|where count&lt;20]|sort action| eval Status=if(count&lt;20,"LESS THANT 20","MORE THAN 20") | eval range = if(Status=="LESS THANT 20","low","elevated")</searchString>
        <earliestTime>$time.earliest$</earliestTime>
        <latestTime>$time.latest$</latestTime>
        <option name="list.wrap">1</option>
        <option name="classField">range</option>
        <option name="field">Status</option>
        <option name="linkView">search</option>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>

[martin_mueller]

Taking that panel XML works for me, the text is displayed as green if the count is zero and yellow otherwise.

Are there any CSS messages logged in your browser's console?
Does the app of that dashboard contain any CSS customization?