Splunk Search

help on single panel abackground color following value displayed

jip31
Motivator

hi

In the code below, I would like that if the condition "No patch in late" in my single panel  = true, the color background = green instead black

I have tried with rangemap but i dont succeed

Could you help me please?

 

 

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| search host=$tok_filterhost$ 
| stats count by host flag_patch_version 
| where isnotnull(flag_patch_version) 
| rename flag_patch_version as "Current Patch level" 
| fields - count 
| eval month=strftime(now(), "%B") 
| rex field="Current Patch level" "^(?<versiontype>W\d+)P(?<version>\d+)" 
| eval version=tonumber(version) 
| eval joiner=versiontype.month 
| join type=left joiner 
    [| inputlookup patch_in_late.csv 
    | rex field=expectedversion "^(?<versiontype>W\d+)P(?<version>\d+)" 
    | eval versionlate=tonumber(version) 
    | eval joiner=versiontype.month 
    | table joiner versionlate ] 
| eval patches_number_in_late=if((versionlate-version)>0, versionlate-version, "Up to date!") 
| appendpipe 
    [| stats count as patches_number_in_late 
    | where patches_number_in_late= 1 ] 
| eval patches_number_in_late=if(patches_number_in_late=1,"No patch in late",patches_number_in_late) 
| table patches_number_in_late

 

 

 

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...