Dashboards & Visualizations

How to modify my single value visualization?

weiquanswq
Explorer

Hi !!
I am new to Splunk and trying to create a single value visualization with 2 values. ( ... | table first, second )
The "first" value determines the value to be displayed.
The "second" value determines the color.

Currently, I am able to display the "first" value but the color is affected by the "first" value.

Is there any suggestion?
Thanks in advance 🙂

0 Karma
1 Solution

sundareshr
Legend

Single value panel accepts/recognizes only one value. Color is based on this single value. Your options are either to color the value or color the trend based on the value for the same field but in the next event. You can set ranges (format) to determine the color, but the range is based on the value in the first (only) field.

View solution in original post

0 Karma

sundareshr
Legend

Single value panel accepts/recognizes only one value. Color is based on this single value. Your options are either to color the value or color the trend based on the value for the same field but in the next event. You can set ranges (format) to determine the color, but the range is based on the value in the first (only) field.

0 Karma

weiquanswq
Explorer

Thanks sundareshr.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @weiquanswq - Did this answer provide the solution to your question? If yes, please don't forget to click "Accept" below this answer to resolve this post. Thanks!

0 Karma

maciep
Champion

how are the first and second values related? I could be mistaken, but I thought the single value only worked with one value - so the coloring would have to be based on that value.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Coloring by value requires stats or timechart. See Customize a single value in the Dashboards and Visualizations manual for complete information.

0 Karma

weiquanswq
Explorer

ChrisG,

I have modified the search to as such

| table id, first, second | stats values(first) as firstVal values(second) as secondVal by id
But it is still affected by firstVal

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...