Splunk Search

Color code single value on other field

mschlager
New Member

I would like to color a single value, based on a field value that is not the one displayed in the panel. I was able to do so previously using the classField option; however, since it is deprecated in 6.4 ,I'm not sure how I would do this.

Tags (1)
0 Karma

renjith_nair
Legend

You might have already resolved the problem but in case you haven't - I am still using the single panel color coding using range with a minor workaround

      <single>
        <title>Status</title>
        <search>
          <query>my search|eval range=if(Status < 1,"severe", "low") |table range Status </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="classField">range</option>
        <option name="field">Status</option>
      </single>

Two things to remember :

  • The variable name should be range in the eval statement and also mention the same in classField option
  • The field you want to display as the value can be provided in the field option.

Hope this helps!

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

helenashton
Path Finder

Did you work this out? I'm trying to do exactly the same thing.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...