I would like the background to be either Red or Green based on the text of "deviceSeverity." The value of deviceSeverity can either be "Up" or "Down." No matter what I do, the background is staying grey. I am new to Splunk formatting and tried searching through these various messages here, but have not had any luck.
This is the latest that I have and am probably over-complicating things (just want background to be red if deviceSeverity is "Down" and background to be green if deviceSeverity is "Up"):
<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="VIP Health Check Status" deviceSeverity=*
| stats latest(deviceSeverity) | eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="classField">deviceSeverity</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
<option name="charting.fieldColors">
{"severe": 0xFF0000, "low": 0x00FF00, "NULL":0xC4C4C0}
</option>
Hi jtoy1986,
If visualization is a Statistics Table then you can define rules for coloring as below
XML:
<table>
<search>
<query>| makeresults
| eval deviceSeverity = "Up"
| append
[| makeresults
| eval deviceSeverity = "Down" ]
| stats latest(deviceSeverity)
| eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="latest(deviceSeverity)">
<colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette>
</format>
</table>
------
An upvote would be appreciated and Accept Solution if it helps!
I'm getting some validation errors. What am I doing wrong? Some say unknown option name for node "single." And node "Format" is not allowed here. Also getting the following after saving, so assuming query is wrong: "Error in 'makeresults' command: This command must be the first command of a search."
<panel>
<title>VIP Health Check Status</title>
<single>
<title>Host: Components</title>
<search>
<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="VIP Health Check Status" deviceSeverity=*
| stats latest(deviceSeverity) | makeresults
| eval deviceSeverity = "Up"
| append
[| makeresults
| eval deviceSeverity = "Down" ]
| stats latest(deviceSeverity)
| eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe") </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="latest(deviceSeverity)">
<colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette>
</format>
</single>
</panel>
I'm also hoping to do the same on some other ones. Basically want to show green or red based on the text that comes back in the query. For example, I am monitoring services and the panel will show "Running" or "Stopped."
deviceSeverity will show either "Running" or "Stopped" below in this case. In my original example, it is "Up" or "Down."
<query>index=arcmisc dvc = $psmserver$ AND deviceProduct = "ApplicationMonitor" name="Cyber-Ark Privileged Session Manager" deviceSeverity=*
| stats latest(deviceSeverity)</query>
Anyone else able to provide some insight on where I'm going wrong with my query? I'd love to do this in other dashboards where I can just show red or green based on text.