topic Re: How to use a variable in colorpalette expression in SimpleXML? in Dashboards & Visualizations

How to use a variable in colorpalette expression in SimpleXML?

Bleepie — Mon, 18 Oct 2021 13:18:43 GMT

Dear Splunk community,

How do I use a variable inside a colorpallete expression using SimpleXML? I have the following:

mySearch | eval myField = 100

If I have a table that returns rows with numbers in them, I can change the color of that row doing so:

<format type="color" field="sourceField"> <colorPalette type="expression">if (value > myField ,"#df5065","#00FF00")</colorPalette> </format>

Expectation: Any row above 100 is red (df5065) and all other fields are green (00FF00).

Result: All rows are green

I need to use myField to calculate with. How do I do that?

I have tried:

$myField$ 'myField' (myField)

None work.

Thanks in advance.

Re: How to use a variable in colorpalette expression in SimpleXML?

renjith_nair — Tue, 19 Oct 2021 07:52:07 GMT

You can set the scaling threshold directly in the table visualization.

Try this run anywhere example and see if it fits.

<dashboard> <label>Color Palette Token</label> <row> <panel> <table> <search> <query>| makeresults count=10 | eval value=(random() % 1000) + 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="value"> <colorPalette type="list">[#53A051,#DC4E41]</colorPalette> <scale type="threshold">100</scale> </format> </table> </panel> </row> </dashboard>

Re: How to use a variable in colorpalette expression in SimpleXML?

Bleepie — Tue, 19 Oct 2021 09:12:09 GMT

This seems to be a treshold that is fixed (at 100). I want to use my variable because its non-fixed. Is that possible?

Re: How to use a variable in colorpalette expression in SimpleXML?

renjith_nair — Thu, 21 Oct 2021 02:09:48 GMT

Yes, try this

Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well

<form> <label>Color Palette Token</label> <fieldset submitButton="false"> <input type="dropdown" token="threshold" searchWhenChanged="true"> <label>Threshold</label> <choice value="100">100</choice> <choice value="200">200</choice> <choice value="300">300</choice> <choice value="500">500</choice> <choice value="800">800</choice> <choice value="1000">1000</choice> <default>100</default> <initialValue>100</initialValue> </input> </fieldset> <row> <panel> <title>$threshold$</title> <table> <search> <query>| makeresults count=10|eval threshold=$threshold$ | eval value=(random() % 1000) + 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="value"> <colorPalette type="expression">if(value > $threshold$, "#DC4E41", "#53A051")</colorPalette> </format> </table> </panel> </row> </form>