I have a chart displaying in dashboard panel. When a value is 0 I'd like to call it out by makeing the text or background of the cell a different color. Is this possible?
I have a chart coded like this:
... | chart count over source by Date
I've been playing with rangemap but it doesn't seem to be working:
index=charlesriver | bucket span=1d _time | stats count first(_time) as Date by _time, source | eval Date=strftime(Date,"%m/%d/%Y %A") | eval source=replace(source,"/apps/wcm-splunk/work/crd/prod/","") | eval source=substr(source,1,len(source)-13) | table Date, source, count | chart count over source by Date | sort Date | rangemap field=count red=0-0
Hallo,
If you are using splunk 6 or more you can use this command: | rangemap field=count severe=0-0 because by default option severe is customized in the share css files and the test color is red:
Splunk_home\share\splunk\search_mrsparkle\exposed\css\bootstrap.min.css
You can have also elevated for color yellow …
Note that you can use this for stats command. For chart command I thing that you need to use Javascript for your dashboard. For more information read splunk Visualization manuel.