Splunk Search

Using eval to change text color in single value module.

Explorer

I am trying to create a single value visualization where the text changes colors based on its value. The criteria for the ranges and colors are:
- 0-67 = Severe
- 67-69 = Warning
- 69-85 = OK
- 85-87 = Warning
- 87-100 = Severe
I tried to use the rangemap function, but discovered that I couldn't use the default "severe", "elevated" color coding if I had two independent ranges for severe and warning. I've managed to confirm that the following search string works, but the color coding is not working. I think the issue is with the fieldColors option, but I'm not sure what I'm missing.

      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>index="pmf_therms" host=5800-106-ADP | stats latest(S1_Temp) as reading | eval okReading=if(reading>75 AND reading<85,reading,0) | eval sevReading=if(reading<67 OR reading>87,reading,0) | eval warnReading=if((reading>67 AND reading<75) OR (reading>85 AND reading<87) ,reading,0)</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,67,"70","84",87,100]</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xebe42d,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
        <option name="afterLabel">°F</option>
        <option name="charting.fieldColors">{"sevReading":0xFF0000,"warnReading":0xFFFF00}</option>
      </single>
Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Hi donfarland,

take and this run everywhere example to display a color changing single value:

<form>
  <label>rangemap</label>
  <fieldset submitButton="true">
    <input type="text" token="field1" searchWhenChanged="true"></input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>| stats count | eval reading=$field1$ | eval ok_level=if(reading>75 AND reading<85,"low",null()) | eval sev_level=if(reading<67 OR reading>87,"severe",null()) | eval warn_level=if((reading>67 AND reading<75) OR (reading>85 AND reading<87),"elevated",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | table reading level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="linkView">search</option>
        <option name="charting.chart.rangeValues">[0,30,40,60,70,100]</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xFFE800,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="drilldown">none</option>
        <option name="afterLabel">°F</option>
        <option name="classField">level</option>
        <option name="field">reading</option>
      </single>
    </panel>
  </row>
</form>

I used a second field level to set the severity, just adapt it to your needs.
The rangemap command is redundant here, because you're expressly setting the option classField and a couple of classes are available out of the box like "low", (green), "elevated" (amber), and "severe" (red).

Hope this helps to get you to your target ...

cheers, MuS

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!