SingleId color change in dashboard

[saleshai]

Hi, I tried to add a piece of code to change the color of values based on certain condition, but it is not reflecting the change in my dashboard. Can you please check & advise what is going wrong?

New code added -

<single id="CurrentUtilisation">
        <search>
          <query>
            <![CDATA[
            index=usage_index_summary
            | fields Index as sourceIndex, totalRawSizeGB
            | where Index="$single_index_name$"
            | stats latest(totalRawSizeGB) as CurrentSize by Index
            | join left=L right=R where L.Index=R.extracted_Index
            [ search index=index_configured_limits_summary
            | stats
            latest(maxGlobalDataSizeGB) as MaxSizeGB
            by extracted_Index
            ]
            | rename L.CurrentSize as CurrentSizeGB, R.MaxSizeGB as MaxSizeGB, L.Index as Index
            | eval unit_label = if(CurrentSizeGB < 1, "MB", "GB")
            | eval CurrentSizeGB = if(CurrentSizeGB < 1, CurrentSizeGB*1024, CurrentSizeGB)
            | eval CurrentSizeDisplay = round(CurrentSizeGB) . if(unit_label == "MB", "MB", "GB")
            | eval CurrentSizeDisplay = if(CurrentSizeGB == 0, "None", CurrentSizeDisplay)
            | eval range=if(CurrentSizeGB > MaxSizeGB, "over", "under")
            | table CurrentSizeDisplay, range
            ]]>
        </query>
        </search>
        <option name="colorBy">value</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["red", "white"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="underLabel">Current Utilisation</option>
        <option name="useColors">1</option>
      </single>

What I want - If Currentsize > Maxsize then the value should display in Red else White. The query on being run independently is showing correct results for the range & current size maxsize values but the color does not change in the dashboard. I have looked up this in the community & tried using the same logic mentioned in this successful solution but to no avail.

Reference used - https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.splunk.com%2Ft5%2FDashbo...

[yuanliu]

If you use <option name="rangeColors" />, shouldn't you also define <option name="rangeValues" />?  Without values, Splunk will no know which color you want to pick.

[saleshai]

I tried that but my range values are "over" & "under" which rangevalues did not accept.
Also tried replacing the string with numeric [1,0] values but no luck with this also

Do you have any suggestion based on what might have worked for you incase of a similar usecase?

[yuanliu]

Color change only applies to numeric values.  Here is a simple example using your "over", "under" range translated into 1, 0.

<form version="1.1" theme="light">
  <label>color range</label>
  <description>https://community.splunk.com/t5/Splunk-Search/SingleId-color-change-in-dashboard/m-p/688284#M234673</description>
  <fieldset submitButton="false">
    <input type="radio" token="value_tok" searchWhenChanged="true">
      <label>Select value</label>
      <choice value="over">Over</choice>
      <choice value="under">Under</choice>
      <default>over</default>
      <initialValue>over</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval value = case("$value_tok$" == "over", "1", "$value_tok$" == "under", "0")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0xdc4e41"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>

[saleshai]

Thanks for your suggestion, I tried using it. But instead adding a radio button & having a token assigned to the values, I simply replaced the over & under with 1,0 (because I'm dependent on the value based on comparison between 2 sizes than having a default value assigned to a radio button) but the color still doesn't change.

I also ran the query separately for a specific index & it returns 1 when currentsize>maxsize but somehow when including in the dashboard code, the color is still not being picked despite using rangevalues & rangeColors both. Is there anything I'm missing here?

<single id="CurrentUtilisation">
<search>
<query>
<![CDATA[
index=usage_index_summary
| fields Index as sourceIndex, totalRawSizeGB
| where Index="$single_index_name$"
| stats latest(totalRawSizeGB) as CurrentSize by Index
| join left=L right=R where L.Index=R.extracted_Index
[ search index=index_configured_limits_summary
| stats
latest(maxGlobalDataSizeGB) as MaxSizeGB
by extracted_Index
]
| rename L.CurrentSize as CurrentSizeGB, R.MaxSizeGB as MaxSizeGB, L.Index as Index
| eval unit_label = if(CurrentSizeGB < 1, "MB", "GB")
| eval CurrentSizeGB = if(CurrentSizeGB < 1, CurrentSizeGB*1024, CurrentSizeGB)
| eval CurrentSizeDisplay = round(CurrentSizeGB) . if(unit_label == "MB", "MB", "GB")
| eval CurrentSizeDisplay = if(CurrentSizeGB == 0, "None", CurrentSizeDisplay)
| eval value=if(CurrentSizeGB > MaxSizeGB, "1", "0")
| table CurrentSizeDisplay, value
]]>
</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0xdc4e41"]</option>
<option name="rangeValues">[0,1]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="underLabel">Current Utilisation</option>
<option name="useColors">1</option>
</single>

[yuanliu]

Your table command contains two fields, one of which is not a number.   Single-value visualization really wants you to have only a single value.  Otherwise you are just confusing the visualizer.