topic Re: Color cell by token from search in Dashboards & Visualizations

Color cell by token from search

noa — Wed, 04 Nov 2020 11:23:53 GMT

Hey there. I have a dashboard with a search query:

Index=my index TestRunId="$RunId$" | dedup TestName | eval Status=case(Outcome==0, "Failed, Outcome==1, "Passed") | table TestName

I want to keep the Outcome per row in a token to enable coloring the test name with his outcome.

How can I do it? Or does there is a way to table both the TestName and the Outcome but not show the outcome, and color the row based the outcome value?

Thanks.

Re: Color cell by token from search

to4kawa — Wed, 04 Nov 2020 11:36:52 GMT

https://community.splunk.com/t5/Dashboards-Visualizations/change-the-color-of-row-based-on-cell-value-in-splunk-without/m-p/525471#M35637

Here's what you need to know.

Re: Color cell by token from search

noa — Wed, 04 Nov 2020 11:50:13 GMT

But I don't want to preview the outcome in my table, can I still do it with SimpleXml?

Re: Color cell by token from search

to4kawa — Sun, 08 Nov 2020 21:33:51 GMT

try <fields>

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-show-more-selected-fields-on-dashboard-event-panel/m-p/310973