Splunk Search

can we give colors in Geostats based on ranges of some value?

SanthoshSreshta
Contributor

Hi.

Can we use rangemaps to give colors to the charts in the geostats map. I am having some range values. they should be in some colors to be displayed in the pie charts on maps. is it possible.
i have used this query but not able to get the defined colors.

 source="Churn_Map.csv" sourcetype="Churn_map" 
| eval Churn = if(Churn="True.","1","0") 
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state  
| eval prop= true_churn*100 / total_churn  
| rangemap field=prop green=0-5 yellow=6-10 orange=11-15 default=red
| geostats values(prop) by StateName   globallimit=0

Thanks.

Tags (3)
0 Karma

jmallorquin
Builder

Hope help you

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#map

mapping.fieldColors and mapping.seriesColors example
The following example configures the "foo" and "bar" fields to be red (0xFF0000) and green (0x00FF00), respectively, and configures all other fields to be blue (0x0000FF):

{foo:0xFF0000,bar:0x00FF00}
[0x0000FF]

0 Karma

SanthoshSreshta
Contributor

I have added
<option name="mapping.fieldColors">{foo:0xFF0000,bar:0x00FF00}</option>
<option name="mapping.seriesColors">[0x0000FF]</option>

everything turns to blue.
what is foo and bar actually.

0 Karma

vganjare
Builder

foo and bar are the fields just like churn, placement or customer

0 Karma

SanthoshSreshta
Contributor

Hi @vganjare
I am trying like this <option name="mapping.seriesColors">{prop:0xC2C199}</option> as you said foo and bar are field names. so i tried using prop as the field name according to my query.
It is not changing. for every color code what i am trying, it is been changing to black color.don't know why.? 😞

0 Karma

araivndswamysai
New Member

Hi Santhosh, did you got any solution to this. am also facing the same issue here. can you please help me.

0 Karma

Arun_N_007
Communicator

You can use it like,

<option name="mapping.fieldColors">{red:0xFF0000,green:0x00FF00,blue:0X0000FF}</option>

Where red,blue, green are values of rangemap field which got calculated.

0 Karma

SanthoshSreshta
Contributor

it is not changing any colors Arun.
i have ranges and its values. i am unable to understand
<option name>"mapping.fieldColors"?{prop:0x0000FF}</option>
I have used that. but no use, any ideas?

0 Karma

jmallorquin
Builder

One trick that you can use, is asign a value to each range, and the by modify the xml change the color.

0 Karma

SanthoshSreshta
Contributor

I have used <option name>"mapping.fieldColors"?{prop:0x0000FF}</option>
but of no use. can you give any example please.

0 Karma

markthompson
Builder

You will find that rangemap uses the following fields:
none = black
low = green
guarded = blue
elevated = yellow
high = orange
severe = red
default

Hope this helps

SanthoshSreshta
Contributor

Hi @markthompson rangemap command must need some values to pass.
I am very new to this SPLUNK. Can you give me some syntax or example like thing to make it.

0 Karma

Arun_N_007
Communicator

Hi Santosh,

Colors are predefined you can't change them. Rangemap colors will not help you with GoogleMap Visualization.

Refer:
http://answers.splunk.com/answers/10250/google-maps-customizing-geo-location-bubble-colors-and-numbe...

0 Karma

SanthoshSreshta
Contributor

Hi @Arun_N_007 , I didn't used any APP. does it still doesn't support such things.?
in the link you have shared there they said it is of APP.

0 Karma

Arun_N_007
Communicator

Hi Santhosh,

Splunk internally used Google Map view to generate maps.

I think it can be done 🙂

Please refer below link for options available.

https://developers.google.com/maps/documentation/javascript/reference#MapOptions

Arun_N_007
Communicator
0 Karma

SanthoshSreshta
Contributor

What ever color code I am adding , it is changing into black color.
I have added.
<option name="mapping.seriesColors">{prop:0xC2C199}</option>
Am i doing wrong.please correct me

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...