Dashboards & Visualizations

rangemap problem in version 5?

jangid
Builder

my search string is

sourcetype=health | head 1 | rangemap field=status default=severe elevated=2-2 low=1-1 | eval field=if(status==1 OR status==2, "Connected", "Not Connected")

and

sourcetype="log" pid_status earliest="-30s" latest=now | dedup host | head 3 | where pid_status="(Active)" |  stats count | rangemap field=count low=2-2 default=severe | eval count=case(count == 0, "Not Running", count == 1, "Not Running", count == 2, "Active", count == 3, "Not Running")

above search works fine in version 4.3.3, build 128297 and I can see colored rectangle.
but when I deploy this in latest version of Splunk - I can't see any colored rectangle in anywhere my app. I am using rangemap in four different view.

is this bug or something wrong in my app?
I have also installed sideview_util app.

Thanks

Tags (1)
0 Karma
1 Solution

Drainy
Champion

Right, I think I've grabbed all the relevant bits. In an application.css in SPLUNK_HOME/etc/apps/APPNAMEOFYOURCHOICE/appserver/static put the following;

.SingleValueHolder {
    background-color: #CCCCCC;
    background-image: url("/en-US/static/@128297/img/skins/default/overlay_gradient_50.png");
    background-repeat: repeat-x;
    border-radius: 4px 4px 4px 4px;
    box-shadow: 0 0 5px rgba(0, 0, 0, 0.25) inset;
    font-size: 14px;
    font-weight: bold;
}
.SingleValue .severe {
    background-color: #BB2121;
    color: #FFFFFF;
}
.SingleValue .high {
    background-color: #E67918;
    color: #FFFFFF;
}
.SingleValue .elevated {
    background-color: #E9DA34;
    color: #000000;
}
.SingleValue .guarded {
    background-color: #4DA6DF;
    color: #FFFFFF;
}
.SingleValue .low {
    background-color: #72C72D;
    color: #FFFFFF;
}
.SingleValue .None {
    background-color: #999999;
    color: #FFFFFF;
}
.SingleValue .singleResult {
    color: #FFFFFF !important;
    font-size: 14px;
    margin: 0px;
    padding-left: 3px;
    vertical-align:0px;
}

EDIT: Added CSS for singleResult, needed to override the new singleResult related CSS in v5

View solution in original post

Drainy
Champion

Right, I think I've grabbed all the relevant bits. In an application.css in SPLUNK_HOME/etc/apps/APPNAMEOFYOURCHOICE/appserver/static put the following;

.SingleValueHolder {
    background-color: #CCCCCC;
    background-image: url("/en-US/static/@128297/img/skins/default/overlay_gradient_50.png");
    background-repeat: repeat-x;
    border-radius: 4px 4px 4px 4px;
    box-shadow: 0 0 5px rgba(0, 0, 0, 0.25) inset;
    font-size: 14px;
    font-weight: bold;
}
.SingleValue .severe {
    background-color: #BB2121;
    color: #FFFFFF;
}
.SingleValue .high {
    background-color: #E67918;
    color: #FFFFFF;
}
.SingleValue .elevated {
    background-color: #E9DA34;
    color: #000000;
}
.SingleValue .guarded {
    background-color: #4DA6DF;
    color: #FFFFFF;
}
.SingleValue .low {
    background-color: #72C72D;
    color: #FFFFFF;
}
.SingleValue .None {
    background-color: #999999;
    color: #FFFFFF;
}
.SingleValue .singleResult {
    color: #FFFFFF !important;
    font-size: 14px;
    margin: 0px;
    padding-left: 3px;
    vertical-align:0px;
}

EDIT: Added CSS for singleResult, needed to override the new singleResult related CSS in v5

jangid
Builder

This change break my app. How to fix this or implement similar look & feel or any other alternate?

0 Karma

rhayle
Path Finder

So how can you bring back the color boxes again?

0 Karma

lguinn2
Legend

In Splunk 5.0, the visualization for a Single Panel has changed. Now the color will show up as text of a different color, rather than a background of a different color. Is this what you are seeing?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...