Dashboards & Visualizations

use colorpallette to change color of extremes on a dashboard

dolj
Explorer

I am trying to change the color of a result based on its deviation from zero. the numbers can be both positive and negative. The range I am trying to implement is as follows,

(-10) <- 0 -> 10 should be #ff0000

(-15) <- (-10) and 10->15 should be #ff8c00

<- (-15) and 15-> should be #ff0000

basically any result from 0 to plus/minus 10 should be green, anything between plus/minus 10 and plus/minus15 should be orange and anything past plus/minus 15 should be red. 

Is this possible?

 

Labels (1)
0 Karma

dolj
Explorer

@livehybrid, both suggestions look great but I am trying to have a field in a table dynamically change based on the result. So one filed in multiple columns will have different colors based on the results in that field.  The idea is to call out the results in red that are >=(+-15). 

0 Karma

dural_yyz
Motivator

I think an example of your table is required at this point.

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @dolj 

Is this what you are after?

livehybrid_0-1741848879903.png

 

I have included the dashboard content below for you to work with and update

{
    "title": "colorpalette",
    "description": "",
    "inputs": {
        "input_global_trp": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range",
            "type": "input.timerange"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_Nh4wq49A": {
            "context": {
                "backgroundColorEditorConfig": [
                    {
                        "to": -15,
                        "value": "#D41F1F"
                    },
                    {
                        "from": -15,
                        "to": -10,
                        "value": "#ff8c00"
                    },
                    {
                        "from": -10,
                        "to": 10,
                        "value": "#669922"
                    },
                    {
                        "from": 10,
                        "to": 15,
                        "value": "#ff8c00"
                    },
                    {
                        "from": 15,
                        "value": "#d41f1f"
                    }
                ]
            },
            "dataSources": {
                "primary": "ds_l00kHfuB_ds_2tFZF9uM"
            },
            "options": {
                "backgroundColor": "> majorValue | rangeValue(backgroundColorEditorConfig)"
            },
            "type": "splunk.singlevalue"
        },
        "viz_OqQGMe3n": {
            "context": {
                "backgroundColorEditorConfig": [
                    {
                        "to": -15,
                        "value": "#D41F1F"
                    },
                    {
                        "from": -15,
                        "to": -10,
                        "value": "#ff8c00"
                    },
                    {
                        "from": -10,
                        "to": 10,
                        "value": "#669922"
                    },
                    {
                        "from": 10,
                        "to": 15,
                        "value": "#ff8c00"
                    },
                    {
                        "from": 15,
                        "value": "#d41f1f"
                    }
                ]
            },
            "dataSources": {
                "primary": "ds_2tFZF9uM"
            },
            "options": {
                "backgroundColor": "> majorValue | rangeValue(backgroundColorEditorConfig)"
            },
            "type": "splunk.singlevalue"
        },
        "viz_P7eqPIQ1": {
            "context": {
                "backgroundColorEditorConfig": [
                    {
                        "to": -15,
                        "value": "#D41F1F"
                    },
                    {
                        "from": -15,
                        "to": -10,
                        "value": "#ff8c00"
                    },
                    {
                        "from": -10,
                        "to": 10,
                        "value": "#669922"
                    },
                    {
                        "from": 10,
                        "to": 15,
                        "value": "#ff8c00"
                    },
                    {
                        "from": 15,
                        "value": "#d41f1f"
                    }
                ]
            },
            "dataSources": {
                "primary": "ds_Poalkk2N_ds_xTGfykmr_ds_l00kHfuB_ds_2tFZF9uM"
            },
            "options": {
                "backgroundColor": "> majorValue | rangeValue(backgroundColorEditorConfig)"
            },
            "type": "splunk.singlevalue"
        },
        "viz_qielOoKy": {
            "context": {
                "backgroundColorEditorConfig": [
                    {
                        "to": -15,
                        "value": "#D41F1F"
                    },
                    {
                        "from": -15,
                        "to": -10,
                        "value": "#ff8c00"
                    },
                    {
                        "from": -10,
                        "to": 10,
                        "value": "#669922"
                    },
                    {
                        "from": 10,
                        "to": 15,
                        "value": "#ff8c00"
                    },
                    {
                        "from": 15,
                        "value": "#d41f1f"
                    }
                ]
            },
            "dataSources": {
                "primary": "ds_xTGfykmr_ds_l00kHfuB_ds_2tFZF9uM"
            },
            "options": {
                "backgroundColor": "> majorValue | rangeValue(backgroundColorEditorConfig)"
            },
            "type": "splunk.singlevalue"
        },
        "viz_s1mEJROK": {
            "context": {
                "backgroundColorEditorConfig": [
                    {
                        "to": -15,
                        "value": "#D41F1F"
                    },
                    {
                        "from": -15,
                        "to": -10,
                        "value": "#ff8c00"
                    },
                    {
                        "from": -10,
                        "to": 10,
                        "value": "#669922"
                    },
                    {
                        "from": 10,
                        "to": 15,
                        "value": "#ff8c00"
                    },
                    {
                        "from": 15,
                        "value": "#d41f1f"
                    }
                ]
            },
            "dataSources": {
                "primary": "ds_kBIEwZOo_ds_Poalkk2N_ds_xTGfykmr_ds_l00kHfuB_ds_2tFZF9uM"
            },
            "options": {
                "backgroundColor": "> majorValue | rangeValue(backgroundColorEditorConfig)"
            },
            "type": "splunk.singlevalue"
        }
    },
    "dataSources": {
        "ds_2tFZF9uM": {
            "name": "Search_1",
            "options": {
                "query": "| makeresults \n| eval num=-16",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_Poalkk2N_ds_xTGfykmr_ds_l00kHfuB_ds_2tFZF9uM": {
            "name": "Search_1 copy 4",
            "options": {
                "query": "| makeresults \n| eval num=11",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_bjOjvTVV_ds_2tFZF9uM": {
            "name": "Search_1 copy 1",
            "options": {
                "query": "| makeresults \n| eval num=-14",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_kBIEwZOo_ds_Poalkk2N_ds_xTGfykmr_ds_l00kHfuB_ds_2tFZF9uM": {
            "name": "Search_1 copy 5",
            "options": {
                "query": "| makeresults \n| eval num=16",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_l00kHfuB_ds_2tFZF9uM": {
            "name": "Search_1 copy 2",
            "options": {
                "query": "| makeresults \n| eval num=-14",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_xTGfykmr_ds_l00kHfuB_ds_2tFZF9uM": {
            "name": "Search_1 copy 3",
            "options": {
                "query": "| makeresults \n| eval num=4",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_global_trp"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_OqQGMe3n",
                        "position": {
                            "h": 250,
                            "w": 250,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_Nh4wq49A",
                        "position": {
                            "h": 250,
                            "w": 250,
                            "x": 260,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_qielOoKy",
                        "position": {
                            "h": 250,
                            "w": 250,
                            "x": 520,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_P7eqPIQ1",
                        "position": {
                            "h": 250,
                            "w": 250,
                            "x": 780,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_s1mEJROK",
                        "position": {
                            "h": 250,
                            "w": 250,
                            "x": 1040,
                            "y": 0
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, for example, try something like this:

    "visualizations": {
        "viz_242vtDn7": {
            "context": {
                "countColumnFormatEditorConfig": {
                    "number": {
                        "thousandSeparated": false,
                        "unitPosition": "after"
                    }
                },
                "countRowColorsEditorConfig": [
                    {
                        "to": -15,
                        "value": "#ff0000"
                    },
                    {
                        "from": -15,
                        "to": -10,
                        "value": "#ff8c00"
                    },
                    {
                        "from": -10,
                        "to": 15,
                        "value": "#ff0000"
                    },
                    {
                        "from": 15,
                        "to": 16,
                        "value": "#ff8c00"
                    },
                    {
                        "from": 16,
                        "value": "#ff0000"
                    }
                ]
            },
            "dataSources": {
                "primary": "ds_zVjhlJmS"
            },
            "options": {
                "columnFormat": {
                    "count": {
                        "align": "auto",
                        "data": "> table | seriesByName(\"count\") | formatByType(countColumnFormatEditorConfig)",
                        "headerAlign": "auto",
                        "rowColors": "> table | seriesByName(\"count\") | rangeValue(countRowColorsEditorConfig)",
                        "textOverflow": "break-word"
                    }
                }
            },
            "type": "splunk.table"
        }
    },

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...