All Apps and Add-ons

rangemap not working on dashboard but working when doing a search

michael_peters
Path Finder

My search returns values and when I run it in search it colours the values correctly:

stats distinct_count(Incident_Number) as test| rangemap field=test low=0-0 default=severe

When I put this as a panel in a dashboard the values are not coloured at all.

I am running 6.0, any ideas why?

The full search is:

* NOT INC_CAL* Priority=1| convert timeformat="%F %T" ctime(Last_Modified_Date) AS "LastModified" ctime(Approval_Date) AS "ApprovalDate" ctime(Completion_Date) AS "CompletionDate" ctime(Submit_Date) AS "SubmitDate" ctime(Expected_Date) AS "ExpectedDate" ctime(Closed_Date) AS "ClosedDate" ctime(Resolved_Date) AS "ResolvedDate" ctime(Reported_Date) AS "ReportedDate" ctime(Responded_Date) AS "RespondedDate"| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-0 default=severe
0 Karma
1 Solution

nfilippi_splunk
Splunk Employee
Splunk Employee

You might be missing the classfield option in your single value xml.

Here is a test dashboard to show the various values of rangemap.

<dashboard>
    <label>Range map color tests</label>
    <row>
        <single>
            <title>low - green</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo low=0-1 | table foo range</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>elevated - yellow</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo elevated=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>severe - red</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo severe=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>high - orange</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo high=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>guarded - blue</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo guarded=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>None - black</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo severe=2-3</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
    </row>
</dashboard>

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

You might be missing the classfield option in your single value xml.

Here is a test dashboard to show the various values of rangemap.

<dashboard>
    <label>Range map color tests</label>
    <row>
        <single>
            <title>low - green</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo low=0-1 | table foo range</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>elevated - yellow</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo elevated=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>severe - red</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo severe=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>high - orange</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo high=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>guarded - blue</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo guarded=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>None - black</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo severe=2-3</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
    </row>
</dashboard>

michael_peters
Path Finder

Yes I do remember this now from my training. Thanks +1.

0 Karma

hemendralodhi
Contributor

Thanks a lot for the answer. I was struggling for past 2 hours and it finally worked with classField option. Many thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...