Splunk Search

Using eval to change text color in single value module.

donfarland
Explorer

I am trying to create a single value visualization where the text changes colors based on its value. The criteria for the ranges and colors are:
- 0-67 = Severe
- 67-69 = Warning
- 69-85 = OK
- 85-87 = Warning
- 87-100 = Severe
I tried to use the rangemap function, but discovered that I couldn't use the default "severe", "elevated" color coding if I had two independent ranges for severe and warning. I've managed to confirm that the following search string works, but the color coding is not working. I think the issue is with the fieldColors option, but I'm not sure what I'm missing.

      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>index="pmf_therms" host=5800-106-ADP | stats latest(S1_Temp) as reading | eval okReading=if(reading>75 AND reading<85,reading,0) | eval sevReading=if(reading<67 OR reading>87,reading,0) | eval warnReading=if((reading>67 AND reading<75) OR (reading>85 AND reading<87) ,reading,0)</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,67,"70","84",87,100]</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xebe42d,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
        <option name="afterLabel">°F</option>
        <option name="charting.fieldColors">{"sevReading":0xFF0000,"warnReading":0xFFFF00}</option>
      </single>
Tags (2)
0 Karma

MuS
Legend

Hi donfarland,

take and this run everywhere example to display a color changing single value:

<form>
  <label>rangemap</label>
  <fieldset submitButton="true">
    <input type="text" token="field1" searchWhenChanged="true"></input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Temp (S1 Rack)</title>
        <search>
          <query>| stats count | eval reading=$field1$ | eval ok_level=if(reading>75 AND reading<85,"low",null()) | eval sev_level=if(reading<67 OR reading>87,"severe",null()) | eval warn_level=if((reading>67 AND reading<75) OR (reading>85 AND reading<87),"elevated",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | table reading level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">minimal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="linkView">search</option>
        <option name="charting.chart.rangeValues">[0,30,40,60,70,100]</option>
        <option name="charting.gaugeColors">[0xd13b3b,0xFFE800,0x7e9f44,0xebe42d,0xd13b3b]</option>
        <option name="drilldown">none</option>
        <option name="afterLabel">°F</option>
        <option name="classField">level</option>
        <option name="field">reading</option>
      </single>
    </panel>
  </row>
</form>

I used a second field level to set the severity, just adapt it to your needs.
The rangemap command is redundant here, because you're expressly setting the option classField and a couple of classes are available out of the box like "low", (green), "elevated" (amber), and "severe" (red).

Hope this helps to get you to your target ...

cheers, MuS

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...