topic Re: Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names? in Dashboards & Visualizations

Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names?

shashankk — Wed, 28 Jun 2023 11:22:26 GMT

Hello Team

I am having a Dashboard created with below Table output. The table is having a dynamic column names (in Date format)

Output as below:

TestMQ	2023-06-23	2023-06-22	2023-06-21	2023-06-20	2023-06-19	2023-06-18	2023-06-17	2023-06-16	And so on - till 30 days
MQ.NAME	5.03	17.04	25.75	19.82	32.14	56.81	10.91	85.14	....

My requirement is to color code these values based on the threshold condition as "[<60 = Green] | [>85 = Red] | [>60 AND <85 = Amber]"

I am new to Splunk and still learning. Kindly suggest how this can be achieved i.e. to modify the dynamic Column values based on the Threshold conditions.

@ITWhisperer

Re: Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names?

dural_yyz — Tue, 27 Jun 2023 14:18:48 GMT

Formatting columns with color is answered here:

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-color-table-cell-on-dashboard-based-on-value/m-p/347851

They referenced the document link here:

http://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML

You want to do column color formats for dynamically named columns which does not appear possible based upon current documentation for xml dashboards. In the table settings the color tablet is applied at the field name level. A dynamically named field can not be accounted for unless you were to hard code all possible options.

Re: Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names?

shashankk — Tue, 27 Jun 2023 15:31:31 GMT

@ITWhisperer - Do you have any suggestions on this please?

Are we suppose to Hard code all possible values and specify the Threshold condition?
How do we use wildcard search here which will apply to all possible Date format values ?

Example below:

Date Format: 2023-06-27

<format type="color" field="202*-*-*">
<colorPalette type="list">[#53A051,#F1813F,#DC4E41]</colorPalette>
<scale type="threshold">60,85</scale>
</format>

Re: Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names?

ITWhisperer — Tue, 27 Jun 2023 15:38:49 GMT

Try removing field so that it applies to all fields.

Re: Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names?

shashankk — Wed, 28 Jun 2023 11:17:16 GMT

@ITWhisperer - Thank you - this works fine! 🙂