topic Visualisation and Color in Splunk Dev

Visualisation and Color

Cam_G — Sun, 18 Oct 2020 10:00:47 GMT

Hello,

I have started working on Splunk recently and have encountered a problem, I cannot find how to add a color (either green or red) to a cell in a table depending if it is "<" or ">".

Most post which I have read are either too complicated for me or are for numbers. I simply want to highlight the cell with the sign.

I have 3 rows, the first and last are for number and the middle is the sign that i want to highlight.

Is there a way in the Search page to do what i want ?

Here is how I get the correct sign :

| eval operator_1 = if( Case1 > Case2 ,">", if(isnotnull(Case1) ,"<","") )

Thank you.

Re: Visualisation and Color

to4kawa — Sun, 18 Oct 2020 10:14:53 GMT

<dashboard> <label>Table with color Based on Status</label> <row> <panel> <title>Compliance check</title> <html depends="$alwaysHideHTMLCSSPanel$"> <style> #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableColorFinalRowBasedOnData"> <search> <query>| makeresults count=10 | eval Case1 = random() % 10, Case2= random() % 10 | eval operator = case( Case1 > Case2 ,">", Case1 < Case2 ,"<",true(), "=" ) | eval color=case(operator=">","HIGH",operator="<","LOW",true(),NULL) | foreach Case* operator [ eval <<FIELD>>=mvappend('<<FIELD>>',color)] | fields - color _time | table Case1 operator Case2</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="refresh.display">progressbar</option> <format type="color" field="Case1"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="Case2"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="operator"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> </table> </panel> </row> </dashboard>

Row? Not a column?

Re: Visualisation and Color

Cam_G — Sun, 18 Oct 2020 10:17:30 GMT

Yes, my bad, I meant column

Re: Visualisation and Color

to4kawa — Sun, 18 Oct 2020 10:18:44 GMT

How about my sample dashboard?

Re: Visualisation and Color

Cam_G — Sun, 18 Oct 2020 10:21:16 GMT

I am not too familiar with XML files that is why I hoped that the solution could be put in the Search area.

As of now I am reading through your reply and trying to understand it.

Thank you for the response.

Re: Visualisation and Color

Cam_G — Sun, 18 Oct 2020 18:40:41 GMT

Thank you,

After much testing, it works fine!