Splunk Search

SingleId color change in dashboard

saleshai
Explorer

Hi, I tried to add a piece of code to change the color of values based on certain condition, but it is not reflecting the change in my dashboard. Can you please check & advise what is going wrong?

New code added -

<single id="CurrentUtilisation">
        <search>
          <query>
            <![CDATA[
            index=usage_index_summary
            | fields Index as sourceIndex, totalRawSizeGB
            | where Index="$single_index_name$"
            | stats latest(totalRawSizeGB) as CurrentSize by Index
            | join left=L right=R where L.Index=R.extracted_Index
            [ search index=index_configured_limits_summary
            | stats
            latest(maxGlobalDataSizeGB) as MaxSizeGB
            by extracted_Index
            ]
            | rename L.CurrentSize as CurrentSizeGB, R.MaxSizeGB as MaxSizeGB, L.Index as Index
            | eval unit_label = if(CurrentSizeGB < 1, "MB", "GB")
            | eval CurrentSizeGB = if(CurrentSizeGB < 1, CurrentSizeGB*1024, CurrentSizeGB)
            | eval CurrentSizeDisplay = round(CurrentSizeGB) . if(unit_label == "MB", "MB", "GB")
            | eval CurrentSizeDisplay = if(CurrentSizeGB == 0, "None", CurrentSizeDisplay)
            | eval range=if(CurrentSizeGB > MaxSizeGB, "over", "under")
            | table CurrentSizeDisplay, range
            ]]>
        </query>
        </search>
        <option name="colorBy">value</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["red", "white"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="underLabel">Current Utilisation</option>
        <option name="useColors">1</option>
      </single>



What I want - If Currentsize > Maxsize then the value should display in Red else White. The query on being run independently is showing correct results for the range & current size maxsize values but the color does not change in the dashboard. I have looked up this in the community & tried using the same logic mentioned in this successful solution but to no avail.

 

Reference used - https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.splunk.com%2Ft5%2FDashbo...

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

If you use <option name="rangeColors" />, shouldn't you also define <option name="rangeValues" />?  Without values, Splunk will no know which color you want to pick.

0 Karma

saleshai
Explorer

I tried that but my range values are "over" & "under" which rangevalues did not accept.
Also tried replacing the string with numeric [1,0] values but no luck with this also

Do you have any suggestion based on what might have worked for you incase of a similar usecase?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Color change only applies to numeric values.  Here is a simple example using your "over", "under" range translated into 1, 0.

<form version="1.1" theme="light">
  <label>color range</label>
  <description>https://community.splunk.com/t5/Splunk-Search/SingleId-color-change-in-dashboard/m-p/688284#M234673</description>
  <fieldset submitButton="false">
    <input type="radio" token="value_tok" searchWhenChanged="true">
      <label>Select value</label>
      <choice value="over">Over</choice>
      <choice value="under">Under</choice>
      <default>over</default>
      <initialValue>over</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>| makeresults
| eval value = case("$value_tok$" == "over", "1", "$value_tok$" == "under", "0")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0xdc4e41"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>
0 Karma

saleshai
Explorer

Thanks for your suggestion, I tried using it. But instead adding a radio button & having a token assigned to the values, I simply replaced the over & under with 1,0 (because I'm dependent on the value based on comparison between 2 sizes than having a default value assigned to a radio button) but the color still doesn't change.

I also ran the query separately for a specific index & it returns 1 when currentsize>maxsize but somehow when including in the dashboard code, the color is still not being picked despite using rangevalues & rangeColors both. Is there anything I'm missing here?

<single id="CurrentUtilisation">
<search>
<query>
<![CDATA[
index=usage_index_summary
| fields Index as sourceIndex, totalRawSizeGB
| where Index="$single_index_name$"
| stats latest(totalRawSizeGB) as CurrentSize by Index
| join left=L right=R where L.Index=R.extracted_Index
[ search index=index_configured_limits_summary
| stats
latest(maxGlobalDataSizeGB) as MaxSizeGB
by extracted_Index
]
| rename L.CurrentSize as CurrentSizeGB, R.MaxSizeGB as MaxSizeGB, L.Index as Index
| eval unit_label = if(CurrentSizeGB < 1, "MB", "GB")
| eval CurrentSizeGB = if(CurrentSizeGB < 1, CurrentSizeGB*1024, CurrentSizeGB)
| eval CurrentSizeDisplay = round(CurrentSizeGB) . if(unit_label == "MB", "MB", "GB")
| eval CurrentSizeDisplay = if(CurrentSizeGB == 0, "None", CurrentSizeDisplay)
| eval value=if(CurrentSizeGB > MaxSizeGB, "1", "0")
| table CurrentSizeDisplay, value
]]>
</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0xdc4e41"]</option>
<option name="rangeValues">[0,1]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="underLabel">Current Utilisation</option>
<option name="useColors">1</option>
</single>
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Your table command contains two fields, one of which is not a number.   Single-value visualization really wants you to have only a single value.  Otherwise you are just confusing the visualizer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...