I have a single value dashboard panel, it displays the status of from a query. I hav the following query that changes the display text color according to the query status.
index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | sort -_time | stats latest(job_result) as dev2status, latest(_time) as dev3t | eval PST=dev3t-25200 | eval Dev2Time=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval host="DEV2" | fields host dev2status Dev2Time | head 1 | eval range=if(dev2status=="FAILURE", "severe", "low")
Now I want to change the background color to either RED or GREEN by the status(SUCCESS or FAILURE), keep the text color as default BLACK.
What I need to do?
Thanks!
have a look at answer by @niketnilay ,
https://answers.splunk.com/answers/541893/changeset-color-of-single-value-visualization-text.html
@pshangguan seems like you need Status Indicator Custom Visualization.
Once you have the Status Indicator Custom Visualization, you can try out the following run anywhere example:
<dashboard>
<label>Status Indicator with Text Icon and Color based on Count</label>
<row>
<panel>
<viz type="status_indicator_app.status_indicator">
<search>
<query>index=_internal sourcetype=splunkd log_level="ERROR"
| stats count by sourcetype
| eval range=case(count>0 AND count<=20,"green",count>20 AND count<=50,"yellow",true(),"red")
| eval icon="server"
| table sourcetype icon range count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
</dashboard>
Please try out and confirm!
have a look at answer by @niketnilay ,
https://answers.splunk.com/answers/541893/changeset-color-of-single-value-visualization-text.html
I will try and see how far I an go with this... Thanks now.
I tried to use the following code:
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
<option name="rangeValues">[4,4.5]</option>
It always display red background.
What I want is to display the environment name in the single value panel, but use "job_result" to decide what color to use. The value for "colorBy" only takes numbers.