help to color a text in a single panel following conditions

[jip31]

hi

I need to color the field "sante" in red if his value is "Etat dégradé" and green if his value os "Etat stable"

| stats count(hang_process_name) AS hang 
| eval sante=if(hang>0, "Etat dégradé", "Etat stable") 
| table sante 
| rangemap field=sante low=0-0 default=severe

what is wrong please?

[richgalloway]

The rangemap command needs numeric values.  This query should color the field as desired, but doesn't use the specified text.

| stats count(hang_process_name) AS hang 
| eval sante=if(hang>0, 1, 0) 
| table sante 
| rangemap field=sante low=0-0 default=severe

[jip31]

sorry, but my needs is to color a text so in my eval command I confirm that I need

| eval sante=if(hang>0, "OK", "KO") 

so rangemap is not the good way due to numeric fields?

[richgalloway · Accepted solution]

Correct.  If the field has to be text then rangemap is not the answer.

If this is part of a dashboard then this answer should help: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condit...

[jip31]

Thanks but I need to display the results in a single panel and not in a table

I have done it works fine

 eval sante=if(hang>1,"KO","OK") 
| table sante  
| eval severity=if(sante="KO",1,0) 
| rangemap field=severity low=0-0 default=severe