Splunk Search

Using eval to change text color in single value module.

donfarland
Explorer

I am trying to create a single value visualization where the text changes colors based on its value. The criteria for the ranges and colors are:
- 0-67 = Severe
- 67-69 = Warning
- 69-85 = OK
- 85-87 = Warning
- 87-100 = Severe
I tried to use the rangemap function, but discovered that I couldn't use the default "severe", "elevated" color coding if I had two independent ranges for severe and warning. I've managed to confirm that the following search string works, but the color coding is not working. I think the issue is with the fieldColors option, but I'm not sure what I'm missing.

      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>index="pmf_therms" host=5800-106-ADP | stats latest(S1_Temp) as reading | eval okReading=if(reading>75 AND reading<85,reading,0) | eval sevReading=if(reading<67 OR reading>87,reading,0) | eval warnReading=if((reading>67 AND reading<75) OR (reading>85 AND reading<87) ,reading,0)</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,67,"70","84",87,100]</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xebe42d,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
        <option name="afterLabel">°F</option>
        <option name="charting.fieldColors">{"sevReading":0xFF0000,"warnReading":0xFFFF00}</option>
      </single>
Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi donfarland,

take and this run everywhere example to display a color changing single value:

<form>
  <label>rangemap</label>
  <fieldset submitButton="true">
    <input type="text" token="field1" searchWhenChanged="true"></input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>| stats count | eval reading=$field1$ | eval ok_level=if(reading>75 AND reading<85,"low",null()) | eval sev_level=if(reading<67 OR reading>87,"severe",null()) | eval warn_level=if((reading>67 AND reading<75) OR (reading>85 AND reading<87),"elevated",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | table reading level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="linkView">search</option>
        <option name="charting.chart.rangeValues">[0,30,40,60,70,100]</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xFFE800,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="drilldown">none</option>
        <option name="afterLabel">°F</option>
        <option name="classField">level</option>
        <option name="field">reading</option>
      </single>
    </panel>
  </row>
</form>

I used a second field level to set the severity, just adapt it to your needs.
The rangemap command is redundant here, because you're expressly setting the option classField and a couple of classes are available out of the box like "low", (green), "elevated" (amber), and "severe" (red).

Hope this helps to get you to your target ...

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...