<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Need help to color code cells in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537247#M36724</link>
    <description>&lt;P&gt;Given that the app states are single words, do you need the +\s in the rex? Perhaps you are ending up with a trailing space which then won't match your colour map?&lt;/P&gt;</description>
    <pubDate>Tue, 26 Jan 2021 16:41:02 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-01-26T16:41:02Z</dc:date>
    <item>
      <title>Need help to color code cells</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537240#M36723</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;I am trying color code App_State cells based on it state in the below table.&lt;/P&gt;&lt;P&gt;App_Name&amp;nbsp; &amp;nbsp; App_State&lt;BR /&gt;abc&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Running&lt;BR /&gt;cde&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Stopped&amp;nbsp;&lt;BR /&gt;fgh&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Running&lt;BR /&gt;xyz&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Running&lt;BR /&gt;mnp&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Stopped&lt;/P&gt;&lt;P&gt;In the dashboard Source:&lt;/P&gt;&lt;P&gt;&amp;lt;dashboard theme="dark" refresh="30"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;ABC&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;row&amp;gt;&lt;BR /&gt;&amp;lt;panel&amp;gt;&lt;BR /&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?&amp;amp;lt;App_Name&amp;amp;gt;\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?&amp;amp;lt;App_State&amp;amp;gt;[\w+\s]+)\sNumber" | table App_Name,App_State&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="rowNumbers"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;format type="color" field="App_State"&amp;gt;&lt;BR /&gt;&amp;lt;colorPalette type="map"&amp;gt;{"Running":#53a051,"Stopped":#dc4e41}&amp;lt;/colorPalette&amp;gt;&lt;BR /&gt;&amp;lt;/format&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;BR /&gt;&amp;lt;/panel&amp;gt;&lt;BR /&gt;&amp;lt;/row&amp;gt;&lt;BR /&gt;&amp;lt;/dashboard&amp;gt;&lt;/P&gt;&lt;P&gt;But I am not getting any colors in the cells.&amp;nbsp;Can someone please look into it and help me get the cells with desired colors..?&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 16:18:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537240#M36723</guid>
      <dc:creator>Mrig342</dc:creator>
      <dc:date>2021-01-26T16:18:20Z</dc:date>
    </item>
    <item>
      <title>Re: Need help to color code cells</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537247#M36724</link>
      <description>&lt;P&gt;Given that the app states are single words, do you need the +\s in the rex? Perhaps you are ending up with a trailing space which then won't match your colour map?&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 16:41:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537247#M36724</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-01-26T16:41:02Z</dc:date>
    </item>
    <item>
      <title>Re: Need help to color code cells</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537253#M36725</link>
      <description>&lt;P&gt;Hi ITWhisperer,&lt;/P&gt;&lt;P&gt;Thanks for your prompt response.&lt;/P&gt;&lt;P&gt;Actually the app states are not single words. It can be as App_State=Partially stopped. So I have used it.&lt;/P&gt;&lt;P&gt;If that's the issue then can you please help me with the rex command to extract it in in the desired way.&lt;/P&gt;&lt;P&gt;Below are the logs:&lt;/P&gt;&lt;P&gt;log1:&amp;nbsp;Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Not running Synchronization : In Sync State : Stopped Number of template version : 6&lt;/P&gt;&lt;P&gt;log2:&amp;nbsp;Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Running Synchronization : Out of Sync State : Partially stopped Number of template version : 6&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 17:01:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537253#M36725</guid>
      <dc:creator>Mrig342</dc:creator>
      <dc:date>2021-01-26T17:01:39Z</dc:date>
    </item>
    <item>
      <title>Re: Need help to color code cells</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537368#M36732</link>
      <description>&lt;P&gt;Not sure if this will help given the logs you shared seem to fit your pattern anyway, but this should remove any trailing space there might have been&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rex field=_raw "(?ms)Sync\sState\s:\s(?&amp;amp;lt;App_State&amp;amp;gt;[\w\s]+\w)\s+Number"&lt;/LI-CODE&gt;&lt;P&gt;The format clause looks like it should work too.&lt;/P&gt;</description>
      <pubDate>Wed, 27 Jan 2021 08:32:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537368#M36732</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-01-27T08:32:56Z</dc:date>
    </item>
    <item>
      <title>Re: Need help to color code cells</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537441#M36735</link>
      <description>&lt;P&gt;Hi ITWhisperer,&lt;/P&gt;&lt;P&gt;It worked..!! I can now see the cells in colors as desired.&lt;/P&gt;&lt;P&gt;Thank you very much for your support...!!&lt;/P&gt;</description>
      <pubDate>Wed, 27 Jan 2021 15:43:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-to-color-code-cells/m-p/537441#M36735</guid>
      <dc:creator>Mrig342</dc:creator>
      <dc:date>2021-01-27T15:43:59Z</dc:date>
    </item>
  </channel>
</rss>

