Splunk Enterprise

help to color a text in a single panel following conditions

jip31
Builder

hi

I need to color the field "sante" in red if his value is "Etat dégradé" and green if his value os "Etat stable"

 

 

| stats count(hang_process_name) AS hang 
| eval sante=if(hang>0, "Etat dégradé", "Etat stable") 
| table sante 
| rangemap field=sante low=0-0 default=severe

 

 

what is wrong please?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Correct.  If the field has to be text then rangemap is not the answer.

If this is part of a dashboard then this answer should help: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condit...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rangemap command needs numeric values.  This query should color the field as desired, but doesn't use the specified text.

| stats count(hang_process_name) AS hang 
| eval sante=if(hang>0, 1, 0) 
| table sante 
| rangemap field=sante low=0-0 default=severe

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma

jip31
Builder

sorry, but my needs is to color a text so in my eval command I confirm that I need

| eval sante=if(hang>0, "OK", "KO") 

so rangemap is not the good way due to numeric fields?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Correct.  If the field has to be text then rangemap is not the answer.

If this is part of a dashboard then this answer should help: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-font-color-based-on-a-condit...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

jip31
Builder

Thanks but I need to display the results in a single panel and not in a table

I have done it works fine

 

 eval sante=if(hang>1,"KO","OK") 
| table sante  
| eval severity=if(sante="KO",1,0) 
| rangemap field=severity low=0-0 default=severe

 

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!