Splunk Search

How to change color of a Panel based on String?

devsru
Explorer

Hi All,I am running a dashboard which returns the total count(stats count) of field mentioning Severity=ok or Severity=Critical.

The requirement is if atealst one field value is Severity=Critical, the color of the panel should turn to Red otherwise Green when Severity=Ok.

 

Can someone please suggest.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK Try this

<dashboard version="1.1" theme="dark">
  <search id="base_search">
    <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y)
    [
    search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m
| stats latest(_time) as time latest(severity) as severity by entity_name kpi
| eval host=lower(mvindex(split(entity_name, "."), 0))
| table host kpi severity time
]
| eval severity=coalesce(severity, 2),  n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S")
| fields - n  _key _timediff
| sort - severity host kpi
| eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") 
| fields host kpi severity
|  rename host as Host, kpi as KPI, severity as Severity 
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <label>Application Dashboard</label>
  <row>
    <panel depends="$alwaysHide$">
      <html>
        <style>
          #single_prd text {
            fill: $single_text_colour$ !important;
          }
        </style>
      </html>
    </panel>
    <panel>
      <title>PRD</title>
      <single id="single_prd">
        <title>Server Name</title>
        <search base="base_search">
          <query>| search Host=xyz* Severity=* 
| stats count count(eval(Severity=="CRITICAL")) as _critical
| eval _colour=if(_critical>0,"red","green")</query>
          <done>
            <set token="single_text_colour">$result._colour$</set>
          </done>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
	 </row>
</dashboard>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You could use CSS to change the colour of the panel using a token which is set based on the results of the search.

0 Karma

devsru
Explorer

@ITWhisperer 

How to achieve this ?

My query is index =* Severity=* | stats count

Here Severity can be either "CRITICAL" or "OK" 

I want to display red if the Severity is "CRITICAL" or "OK" . (It can be 100 events OK and 50 as CRITICAL.) If all are OK then display GREEN 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with this

index =* Severity=* | stats count(eval(Severity=="CRITICAL")) as Critical count(eval(Severity=="OK")) as OK
| eval colour=if(insnotnull(Critical) and Critical > 0, "red", "green")

Then in your done handler, set a token to $result.colour$ and use this token in your CSS.

0 Karma

devsru
Explorer

Hi @ITWhisperer  Apologies but I don't know using CSS. Will it be possible to provide me the XML.

For example I want to highlight the server vmp-stata-01 as Red as it has one "critical" Severity field and 8 "OK"

Capture.PNG

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your dashboard source for this panel in a codeblock

0 Karma

devsru
Explorer
<dashboard version="1.1" theme="dark">
  <search id="base_search">
    <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y)
    [
    search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m
| stats latest(_time) as time latest(severity) as severity by entity_name kpi
| eval host=lower(mvindex(split(entity_name, "."), 0))
| table host kpi severity time
]
| eval severity=coalesce(severity, 2),  n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S")
| fields - n  _key _timediff
| sort - severity host kpi
| eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") 
| fields host kpi severity
|  rename host as Host, kpi as KPI, severity as Severity 
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <label>Application Dashboard</label>
  <row>
    <panel>
      <title>PRD</title>
      <single>
        <title>Server Name</title>
        <search base="base_search">
          <query>| search Host=xyz* Severity=* 
| stats count</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
	 </row>
</dashboard>
0 Karma

devsru
Explorer

@ITWhisperer  Appreciate your help on this one.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

<dashboard version="1.1" theme="dark">
  <search id="base_search">
    <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y)
    [
    search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m
| stats latest(_time) as time latest(severity) as severity by entity_name kpi
| eval host=lower(mvindex(split(entity_name, "."), 0))
| table host kpi severity time
]
| eval severity=coalesce(severity, 2),  n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S")
| fields - n  _key _timediff
| sort - severity host kpi
| eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") 
| fields host kpi severity
|  rename host as Host, kpi as KPI, severity as Severity 
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <label>Application Dashboard</label>
  <row>
    <panel>
      <title>PRD</title>
      <single>
        <title>Server Name</title>
        <search base="base_search">
          <query>| search Host=xyz* Severity=*
| eval range=if(Severity=="CRITICAL",6,0) 
| fields Host KPI range</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xff0000"]</option>
        <option name="rangeValues">[6]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
	 </row>
</dashboard>
0 Karma

devsru
Explorer

Hi @ITWhisperer  I  tried but this Sub query but it won't work because I have more than 100 KPI's. Here I am interested only in the count and turn Red/Green if any one of the Severity is triggered. 

 

  <query>| search Host=xyz* Severity=*
| eval range=if(Severity=="CRITICAL",6,0) 
| fields Host KPI range</query>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK Try this

<dashboard version="1.1" theme="dark">
  <search id="base_search">
    <query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y)
    [
    search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m
| stats latest(_time) as time latest(severity) as severity by entity_name kpi
| eval host=lower(mvindex(split(entity_name, "."), 0))
| table host kpi severity time
]
| eval severity=coalesce(severity, 2),  n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S")
| fields - n  _key _timediff
| sort - severity host kpi
| eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL") 
| fields host kpi severity
|  rename host as Host, kpi as KPI, severity as Severity 
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <label>Application Dashboard</label>
  <row>
    <panel depends="$alwaysHide$">
      <html>
        <style>
          #single_prd text {
            fill: $single_text_colour$ !important;
          }
        </style>
      </html>
    </panel>
    <panel>
      <title>PRD</title>
      <single id="single_prd">
        <title>Server Name</title>
        <search base="base_search">
          <query>| search Host=xyz* Severity=* 
| stats count count(eval(Severity=="CRITICAL")) as _critical
| eval _colour=if(_critical>0,"red","green")</query>
          <done>
            <set token="single_text_colour">$result._colour$</set>
          </done>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
	 </row>
</dashboard>

devsru
Explorer

Hi @ITWhisperer  Wonderful. The solution seems to be working. I have a small modification in requirement. 

If the Severity is "Critical" then it should display Red, If "OK" then green , if "Amber" then yellow. 

 

Can you please help me with that.

0 Karma

devsru
Explorer

@ITWhisperer  Can you tell me the correct quere based on the case mentioned in my previous reply.

 

| stats count count(eval(Severity=="CRITICAL")) as _critical
| eval _colour=if(_critical>0,"red","green")</query>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

See my previous response

0 Karma

devsru
Explorer

@ITWhisperer 

I managed to do this with below query. Thanks for all your help

 

| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red","green",_critical=0 AND _medium>0,"yellow","green",_critical=0 AND _medium=0,"green","red")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like your case function is not set up correctly, although this could just be a copy/paste error?

0 Karma

devsru
Explorer

@ITWhisperer 

Indeed it was a typo 🙂

| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK now your logic seems a little unrobust. What happens if _critical > 0 and _medium = 0?

0 Karma

devsru
Explorer

@ITWhisperer  Thanks for pointing it out as i am new in SPL 😞

 

Is this alright ?

| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "yellow")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not really a SPL issue, it is logic. You tell me - what would be set if _critical is 1 and _medium is 0?

Is this what you want it to be?

0 Karma

devsru
Explorer

@ITWhisperer  I am not checking the query before replying 😞

I set it to red now.

 

| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...