I'm working on a dashboard for metrics and one of the metrics is a ratio; I would like to color the ration red, yellow, or green based on percentage values.
The "easy" solution is just to display a percentage and we can easily use the interface to set threshold values for the colors. I would really like to display a ration, however.
If I use a ratio, I can calculate the percent, use rangemap to set the follow, and then classField to se the color. The problem with this approach is classField is set as deprecated. I would assume if it has been deprecated, they have thought through the use cases and have a way to display one field (the ratio) but use another (the percentage) for coloring, but I haven't figured it out yet.
try adding this eval (though you may need to swap the signs/order) to the end of your query:
|eval range=case(percentage>xx,"severe",percentage>xx,"elevated",percentage>xx,"low")
these colors relate to those values.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting#Migration_for_rangemap_...
and add <option name="field">ratio</option>
to your options