topic How to color code column using expression(without JS) ? in Splunk Enterprise

How to color code column using expression(without JS) ?

sangs8788 — Fri, 12 Jun 2020 06:52:48 GMT

I have a table which displays duration for each category. I would like color code fields based on its duration.

In the above screenshot, how do I write an expression to color code which are exceeding 1min.

I would prefer using the color coding from the source rather than creating JSS because we dont have the permission to splunk servers as such to update config/put the JS scripts. Could someone please help me out here

Re: How to color code column using expression(without JS) ?

twesty — Fri, 12 Jun 2020 08:52:38 GMT

You can edit the table in the UI editor and select the column header for some coloration options.

They are a little on the limited side but as far as I know, thats the best option there is. When you have selected a coloration, I would check the xml in the back to see whether there's further control within the table for extra params.

The docs here may also be of use: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference