Splunk Search

How to choose color based on text value?

smanojkumar
Contributor

Hi there!

    I need to choose the color in the dashboard based on the text results in dashboard,

   where the value is "OK", it should be in green color,

    where the value is "Ko", it should be in red color,

this is the only field that the dashboard returns.

 

Thanks in Advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<format type="color">
  <colorPalette type="map">{"KO":#FF0000, "OK":#00FF00}</colorPalette>
</format>
0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

    Is this code being same for single value visualization?
I can see it works fine for table, but I need it for Single value visualization,

 

Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are right, this doesn't work for single visualisations. Instead you could ddd an extra field to your query called range.

| eval range=if(value=="OK","low","severe")
0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

Can you please help me here, where i need to make change, i just made in query, i'm having some error

 

<form theme="dark">
  <label> ASSET STATUS</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="category" searchWhenChanged="true">
      <label>Category</label>
      <choice value="work">Work</choice>
      <choice value="auto">Auto</choice>
      <choice value="server">Server</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>work</default>
      <change>
        <condition value="work">
          <set token="Work">"Work"</set>
          <unset token="Auto"></unset>
        </condition>
        <condition value="auto">
          <set token="Auto">"Auto"</set>
          <unset token="Work"></unset>
        </condition>
        <condition value="server">
          <set token="Server">"Server"</set>
          <unset token="Work"></unset>
          <unset token="Auto"></unset>
        </condition>
      </change>
    </input>
    <input type="text" token="src_name" searchWhenChanged="true">
      <label>src_name</label>
      <default>*</default>
    </input>
  </fieldset>
<row>
              <panel>
<title>SOC CHECK</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, soc_check
| search src_name IN ($src_name$)
| eval soc_check=if(soc_check=1,"OK","KO")
| eval range=if(value=="OK","low","severe")
| table soc_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
</row>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What has this to do with your original question?

0 Karma

smanojkumar
Contributor

In the above query, I added eval range command, since i didn't get the expected one,

 

Same, If the soc_check is "OK", the result should be in green colour, if the soc_check is "KO", the result should be in red colour

0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

    If the soc_check is "OK", the result should be in green color, if the soc_check is "KO", the result should be in red color, with the above query

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that you didn't originally give much information, I would have expected you to adapt any solution given to your specific circumstances.

Try changing

| eval range=if(value=="OK","low","severe")

to

| eval range=if(soc_check=="OK","low","severe")

since this is the field you appear to be using

0 Karma

smanojkumar
Contributor

Hi @ITWhisperer 

   The query is working but the color is still not changed.

 

Thanks!

0 Karma

Manasa_401
Communicator

Hello @smanojkumar 

Are you fetching the range field in table output fields?
If not, give both soc_check and range fields in table command.

If this helps, karma would be appreciated.

Thanks,

Manasa

0 Karma

smanojkumar
Contributor

Hi @Manasa_401 

   Even after adding range field in table command, i cant see the color change,

 

My requirement is to check the soc_check field value color based on its values

OK- green

KO-Red

0 Karma

Manasa_401
Communicator

Try again by disabling the usecolors option

0 Karma

smanojkumar
Contributor

Hi @Manasa_401 

   Still, I didn't get the expected after removing the command.

0 Karma

smanojkumar
Contributor

Hi @ITWhisperer 

   Can you help me in this?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...