Dashboards & Visualizations

Color for text value

janitka
Explorer

Hello,

could someone help what to modify in bellow search, as i want to display red/green color if the value is True or False

sourcetype="xendesktop:7:machine" MachineName="$MachineName$" | table InMaintenanceMode | rename InMaintenanceMode as Maintenance | replace False with OFF in Maintenance | replace True with ON in Maintenance

Why is there no option for text, same as for numerical values?

Regards,
Jan

Tags (2)

efavreau
Motivator

@janitka There's lots of comparison operators and navigating which does what can be difficult. Especially since there can often be more than one way to get to an answer. However, you did the right thing and asking for opinions on Splunk Answers.
Use this run anywhere example to see that I can take the text you have given and created an example that results in a Maintenance column with ON and OFF values.

| makeresults
| eval _raw="MachineID,MachineName,MaintenanceMode
  1,Yoda,True
  2,Dooku,True
  3,Jinn,True
  4,Kenobi,False
  5,Skywalker,False
  6,Tano,False" 
| multikv 
| table MachineName MaintenanceMode
| eval State=case(
     match(MaintenanceMode,"True"), "ON",
     match(MaintenanceMode,"False"), "OFF"
     )
| rename State AS Maintenance

Here I am using a case statement to evaluate more than one case (or situation). Then I use the match function on the MaintenanceMode field, match on the word "True" and if it matches, call it "ON".
For me, there's a lot of power in using case and eval functions. I reference the following doc a lot when I get stuck:
https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/CommonEvalFunctions

Here are some screenshots of selecting colors based on text values. One is after you click the pencil/art brush in the top of the column, and the other is the result.
https://imgur.com/HTd182q
https://imgur.com/WfbZ0zL

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...