Splunk Search

How to choose color based on text value?

smanojkumar
Communicator

Hi there!

    I need to choose the color in the dashboard based on the text results in dashboard,

   where the value is "OK", it should be in green color,

    where the value is "Ko", it should be in red color,

this is the only field that the dashboard returns.

 

Thanks in Advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<format type="color">
  <colorPalette type="map">{"KO":#FF0000, "OK":#00FF00}</colorPalette>
</format>
0 Karma

smanojkumar
Communicator

Hi @ITWhisperer ,

    Is this code being same for single value visualization?
I can see it works fine for table, but I need it for Single value visualization,

 

Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are right, this doesn't work for single visualisations. Instead you could ddd an extra field to your query called range.

| eval range=if(value=="OK","low","severe")
0 Karma

smanojkumar
Communicator

Hi @ITWhisperer ,

Can you please help me here, where i need to make change, i just made in query, i'm having some error

 

<form theme="dark">
  <label> ASSET STATUS</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="category" searchWhenChanged="true">
      <label>Category</label>
      <choice value="work">Work</choice>
      <choice value="auto">Auto</choice>
      <choice value="server">Server</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>work</default>
      <change>
        <condition value="work">
          <set token="Work">"Work"</set>
          <unset token="Auto"></unset>
        </condition>
        <condition value="auto">
          <set token="Auto">"Auto"</set>
          <unset token="Work"></unset>
        </condition>
        <condition value="server">
          <set token="Server">"Server"</set>
          <unset token="Work"></unset>
          <unset token="Auto"></unset>
        </condition>
      </change>
    </input>
    <input type="text" token="src_name" searchWhenChanged="true">
      <label>src_name</label>
      <default>*</default>
    </input>
  </fieldset>
<row>
              <panel>
<title>SOC CHECK</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, soc_check
| search src_name IN ($src_name$)
| eval soc_check=if(soc_check=1,"OK","KO")
| eval range=if(value=="OK","low","severe")
| table soc_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
</row>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What has this to do with your original question?

0 Karma

smanojkumar
Communicator

In the above query, I added eval range command, since i didn't get the expected one,

 

Same, If the soc_check is "OK", the result should be in green colour, if the soc_check is "KO", the result should be in red colour

0 Karma

smanojkumar
Communicator

Hi @ITWhisperer ,

    If the soc_check is "OK", the result should be in green color, if the soc_check is "KO", the result should be in red color, with the above query

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that you didn't originally give much information, I would have expected you to adapt any solution given to your specific circumstances.

Try changing

| eval range=if(value=="OK","low","severe")

to

| eval range=if(soc_check=="OK","low","severe")

since this is the field you appear to be using

0 Karma

smanojkumar
Communicator

Hi @ITWhisperer 

   The query is working but the color is still not changed.

 

Thanks!

0 Karma

Manasa_401
Communicator

Hello @smanojkumar 

Are you fetching the range field in table output fields?
If not, give both soc_check and range fields in table command.

If this helps, karma would be appreciated.

Thanks,

Manasa

0 Karma

smanojkumar
Communicator

Hi @Manasa_401 

   Even after adding range field in table command, i cant see the color change,

 

My requirement is to check the soc_check field value color based on its values

OK- green

KO-Red

0 Karma

Manasa_401
Communicator

Try again by disabling the usecolors option

0 Karma

smanojkumar
Communicator

Hi @Manasa_401 

   Still, I didn't get the expected after removing the command.

0 Karma

smanojkumar
Communicator

Hi @ITWhisperer 

   Can you help me in this?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...