Dashboards & Visualizations

single value not changing colour

kris99
New Member

following not displaying colour within the form.

If search finds events between 3012 - 3054, display Warning in Yellow (i.e elevated).

If I search and view as elevated, its displays the count of events in Yellow. But this is not working in form.

HV-test

<single>
  <title>HV Err</title>
  <searchString>index =xxx  Type!=Information  (EventCode&gt;="3012" AND EventCode&lt;="3054") | stats count | appendpipe [ stats count | eval Status="No Errors" | where count==0 ] | eval Status=if(count==0,"No Errors","Warning") | eval range = if(Status=="No Errors","low","elevated")</searchString>
  <earliestTime>-7d@h</earliestTime>
  <latestTime>now</latestTime>
  <option name="list.wrap">1</option>
  <option name="classField">range</option>
  <option name="field">Status</option>
</single>
0 Karma

paulmarticsi
Explorer

Get the Status Indicator app - it will allow you to do single value text with colors and icons. There are examples in the Dashboard Examples app by Splunk.
,A better way to go is to get the 'Status Indicator' app. Think of it as a super-powered single value visualization. I did the same thing with it and it includes the capacity to add an icon based on output.

0 Karma

stephanefotso
Motivator

It should work. I made a code similar to yours, with forms inputs, and that works very well. Take a look at it.

<form>
  <label>single_value_changing_color</label>
  <description/>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="action" searchWhenChanged="true">
      <label>Choose one action</label>
      <choice value="*">All</choice>
      <populatingSearch fieldForLabel="action" fieldForValue="action">index=_audit|stats count by action|sort action</populatingSearch>
      <default>change_own_password</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>HV Err</title>
        <searchString>index=_audit action=$action$ | stats count by   user | appendpipe [stats sum(count) as count  | eval Status = "LESS THANT 20"|where count&lt;20]|sort action| eval Status=if(count&lt;20,"LESS THANT 20","MORE THAN 20") | eval range = if(Status=="LESS THANT 20","low","elevated")</searchString>
        <earliestTime>$time.earliest$</earliestTime>
        <latestTime>$time.latest$</latestTime>
        <option name="list.wrap">1</option>
        <option name="classField">range</option>
        <option name="field">Status</option>
        <option name="linkView">search</option>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Taking that panel XML works for me, the text is displayed as green if the count is zero and yellow otherwise.

Are there any CSS messages logged in your browser's console?
Does the app of that dashboard contain any CSS customization?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>