Splunk Search

Chart Background or Text Color

andrewkenth
Communicator

I have a chart displaying in dashboard panel. When a value is 0 I'd like to call it out by makeing the text or background of the cell a different color. Is this possible?

I have a chart coded like this:
... | chart count over source by Date

I've been playing with rangemap but it doesn't seem to be working:

index=charlesriver | bucket span=1d _time | stats count first(_time) as Date by _time, source | eval Date=strftime(Date,"%m/%d/%Y %A")  | eval source=replace(source,"/apps/wcm-splunk/work/crd/prod/","")  | eval source=substr(source,1,len(source)-13)  | table Date, source, count | chart count over source by Date | sort Date | rangemap field=count red=0-0 
Tags (2)
0 Karma

Patient
Path Finder

Hallo,
If you are using splunk 6 or more you can use this command: | rangemap field=count severe=0-0 because by default option severe is customized in the share css files and the test color is red:
Splunk_home\share\splunk\search_mrsparkle\exposed\css\bootstrap.min.css
You can have also elevated for color yellow …
Note that you can use this for stats command. For chart command I thing that you need to use Javascript for your dashboard. For more information read splunk Visualization manuel.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...

Index This | What is feather-light but cannot be held long?

May 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

.conf26 Registration is Live: Secure Your Early Bird Pass Now

  Lock in Your Spot: Registration Open for .conf26 in Denver Hello Splunkers, I have exciting news! Your ...