Splunk Search

Using eval to change text color in single value module.

donfarland
Explorer

I am trying to create a single value visualization where the text changes colors based on its value. The criteria for the ranges and colors are:
- 0-67 = Severe
- 67-69 = Warning
- 69-85 = OK
- 85-87 = Warning
- 87-100 = Severe
I tried to use the rangemap function, but discovered that I couldn't use the default "severe", "elevated" color coding if I had two independent ranges for severe and warning. I've managed to confirm that the following search string works, but the color coding is not working. I think the issue is with the fieldColors option, but I'm not sure what I'm missing.

      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>index="pmf_therms" host=5800-106-ADP | stats latest(S1_Temp) as reading | eval okReading=if(reading>75 AND reading<85,reading,0) | eval sevReading=if(reading<67 OR reading>87,reading,0) | eval warnReading=if((reading>67 AND reading<75) OR (reading>85 AND reading<87) ,reading,0)</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,67,"70","84",87,100]</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xebe42d,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
        <option name="afterLabel">°F</option>
        <option name="charting.fieldColors">{"sevReading":0xFF0000,"warnReading":0xFFFF00}</option>
      </single>
Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi donfarland,

take and this run everywhere example to display a color changing single value:

<form>
  <label>rangemap</label>
  <fieldset submitButton="true">
    <input type="text" token="field1" searchWhenChanged="true"></input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>| stats count | eval reading=$field1$ | eval ok_level=if(reading>75 AND reading<85,"low",null()) | eval sev_level=if(reading<67 OR reading>87,"severe",null()) | eval warn_level=if((reading>67 AND reading<75) OR (reading>85 AND reading<87),"elevated",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | table reading level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="linkView">search</option>
        <option name="charting.chart.rangeValues">[0,30,40,60,70,100]</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xFFE800,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="drilldown">none</option>
        <option name="afterLabel">°F</option>
        <option name="classField">level</option>
        <option name="field">reading</option>
      </single>
    </panel>
  </row>
</form>

I used a second field level to set the severity, just adapt it to your needs.
The rangemap command is redundant here, because you're expressly setting the option classField and a couple of classes are available out of the box like "low", (green), "elevated" (amber), and "severe" (red).

Hope this helps to get you to your target ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...