Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Customize a single value

Learn how to configure single value visualization components.

Value ranges and colors

Colors can emphasize range values or trends in a single value visualization. In the Format menu, you can choose whether to use colors. If you opt to use colors, you can select whether to color by value or trend.
Note: For queries using stats to aggregate results, only the color by value option is available.
You can also adjust the color mode to change whether colors appear in the foreground or background.

6.3.0 Single value viz foreground Color Mode.png Fluttershy Single Value Sparkline Week To Date.png

Depending on the color mode you choose, coloring a single value generated with timechart by value means that the sparkline and trend indicator appear black (for foreground color) or white (for background color).

Color by value

Coloring by value is available for single value visualizations generated with either stats or timechart. Color by value means that the single numeric value in the visualization changes color based on the value the search generates and the range for that value. For example, if you map a value range from 30-50 to the color yellow, then a single value of 35 appears yellow.

You can adjust value ranges for the query to change how different results are visualized. By default, there are five ranges and colors for coloring by value. You can add or remove ranges, modify the values for each range, and change the colors associated with each range using the Format menu.

For example, this timechart generated single value visualization shows color by value and has the background color mode selected.

Fluttershy single value background color mode.png

Color by trend

Coloring by trend is available for single values generated with a query including the timechart command. Coloring by trend means that the sparkline and trend indicator in this visualization change color to show changes in data. By default, positive changes make the sparkline and trend indicator appear green, while negative changes make them red. When results show no change, the trend color is black.

For example, this visualization shows color by trend and has the foreground color mode selected.

Fluttershy single value foreground trend.png

You can reverse the settings for trend colors in the Format menu. You can also specify a different trend time window for the visualization.

Migration for rangemap settings in existing single value visualizations

Existing single value visualizations might use a query with the rangemap command to configure ranges and colors.

By default, a single value visualization has this color mapping configuration for ranges.

  • low: green
  • guarded: blue
  • elevated: yellow
  • high: orange
  • severe: red

Caution: As support for the rangemap command is limited, it is not recommended for building new single value visualizations. Queries using rangemap currently generate a single value, but UI configurations override the query-based settings.

For existing single value visualizations, it is recommended to migrate rangemap command settings out of the query. Replace query-based settings with equivalent range and color settings in the Format menu Color panel.

Captions and units

Use the Format menu's General options panel to add a caption for a single value visualization. You can specify a unit of measurement and its position in the Number Format panel. For instance, you can add $ before a value reflecting sales in the United States or MB after a value tracking data transfers.

Note: If you are migrating from earlier versions of Splunk software and your visualization includes Before and After labels, the Format menu shows prompts to update label and unit text using the Unit and Caption fields.

Captions

Captions add descriptive context to a single value visualization. To add a caption, select the Format menu General panel. Use the caption text field here to enter a description. Captions appear below the single value.

Units

Units can indicate standard measurements for single values. To add a unit to the visualization, select the Format menu Number Format panel and edit the Unit field. You can choose whether a unit appears before or after the value. It is recommended to keep unit text to five characters or fewer. Use a caption for longer text.


Number formatting

If you are working with a large single value or one that requires precision, you can change the number formatting for the visualization. In the Format menu Number Format panel, you can choose thousand separators or different degrees of decimal precision.


Drilldown

By default, drilldown is disabled for single value visualizations. For more information about enabling and configuring drilldown, see Use drilldown for dashboard interactivity.

Last modified on 01 February, 2017
PREVIOUS
Generate a single value
  NEXT
Using gauges

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.5, 8.0.10, 7.2.1, 7.0.1, 8.0.4, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 8.0.6, 8.0.7, 8.0.8


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters