Splunk Search

help on single panel abackground color following value displayed

jip31
Motivator

hi

In the code below, I would like that if the condition "No patch in late" in my single panel  = true, the color background = green instead black

I have tried with rangemap but i dont succeed

Could you help me please?

 

 

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| search host=$tok_filterhost$ 
| stats count by host flag_patch_version 
| where isnotnull(flag_patch_version) 
| rename flag_patch_version as "Current Patch level" 
| fields - count 
| eval month=strftime(now(), "%B") 
| rex field="Current Patch level" "^(?<versiontype>W\d+)P(?<version>\d+)" 
| eval version=tonumber(version) 
| eval joiner=versiontype.month 
| join type=left joiner 
    [| inputlookup patch_in_late.csv 
    | rex field=expectedversion "^(?<versiontype>W\d+)P(?<version>\d+)" 
    | eval versionlate=tonumber(version) 
    | eval joiner=versiontype.month 
    | table joiner versionlate ] 
| eval patches_number_in_late=if((versionlate-version)>0, versionlate-version, "Up to date!") 
| appendpipe 
    [| stats count as patches_number_in_late 
    | where patches_number_in_late= 1 ] 
| eval patches_number_in_late=if(patches_number_in_late=1,"No patch in late",patches_number_in_late) 
| table patches_number_in_late

 

 

 

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...