Splunk Search

How to choose color based on text value?

smanojkumar
Contributor

Hi there!

    I need to choose the color in the dashboard based on the text results in dashboard,

   where the value is "OK", it should be in green color,

    where the value is "Ko", it should be in red color,

this is the only field that the dashboard returns.

 

Thanks in Advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<format type="color">
  <colorPalette type="map">{"KO":#FF0000, "OK":#00FF00}</colorPalette>
</format>
0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

    Is this code being same for single value visualization?
I can see it works fine for table, but I need it for Single value visualization,

 

Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are right, this doesn't work for single visualisations. Instead you could ddd an extra field to your query called range.

| eval range=if(value=="OK","low","severe")
0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

Can you please help me here, where i need to make change, i just made in query, i'm having some error

 

<form theme="dark">
  <label> ASSET STATUS</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="category" searchWhenChanged="true">
      <label>Category</label>
      <choice value="work">Work</choice>
      <choice value="auto">Auto</choice>
      <choice value="server">Server</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>work</default>
      <change>
        <condition value="work">
          <set token="Work">"Work"</set>
          <unset token="Auto"></unset>
        </condition>
        <condition value="auto">
          <set token="Auto">"Auto"</set>
          <unset token="Work"></unset>
        </condition>
        <condition value="server">
          <set token="Server">"Server"</set>
          <unset token="Work"></unset>
          <unset token="Auto"></unset>
        </condition>
      </change>
    </input>
    <input type="text" token="src_name" searchWhenChanged="true">
      <label>src_name</label>
      <default>*</default>
    </input>
  </fieldset>
<row>
              <panel>
<title>SOC CHECK</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, soc_check
| search src_name IN ($src_name$)
| eval soc_check=if(soc_check=1,"OK","KO")
| eval range=if(value=="OK","low","severe")
| table soc_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
</row>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What has this to do with your original question?

0 Karma

smanojkumar
Contributor

In the above query, I added eval range command, since i didn't get the expected one,

 

Same, If the soc_check is "OK", the result should be in green colour, if the soc_check is "KO", the result should be in red colour

0 Karma

smanojkumar
Contributor

Hi @ITWhisperer ,

    If the soc_check is "OK", the result should be in green color, if the soc_check is "KO", the result should be in red color, with the above query

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that you didn't originally give much information, I would have expected you to adapt any solution given to your specific circumstances.

Try changing

| eval range=if(value=="OK","low","severe")

to

| eval range=if(soc_check=="OK","low","severe")

since this is the field you appear to be using

0 Karma

smanojkumar
Contributor

Hi @ITWhisperer 

   The query is working but the color is still not changed.

 

Thanks!

0 Karma

Manasa_401
Communicator

Hello @smanojkumar 

Are you fetching the range field in table output fields?
If not, give both soc_check and range fields in table command.

If this helps, karma would be appreciated.

Thanks,

Manasa

0 Karma

smanojkumar
Contributor

Hi @Manasa_401 

   Even after adding range field in table command, i cant see the color change,

 

My requirement is to check the soc_check field value color based on its values

OK- green

KO-Red

0 Karma

Manasa_401
Communicator

Try again by disabling the usecolors option

0 Karma

smanojkumar
Contributor

Hi @Manasa_401 

   Still, I didn't get the expected after removing the command.

0 Karma

smanojkumar
Contributor

Hi @ITWhisperer 

   Can you help me in this?

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...