topic Re: colorpallette expression not matching field value in Dashboards & Visualizations

colorpallette expression not matching field value

thaghost99 — Thu, 29 Feb 2024 17:08:03 GMT

hi, need some help, i have this format type but it seems the word 'up' is not matching for whatever reason.

there is no spaces or anything in the field value.

the field value is extracted using 'rex'.

i have this working in other fields, but this one got me stuck.

any help will be appreciated.

<format type="color" field="state"> <colorPalette type="expression">if (value == "up","#Green", "#Yellow")</colorPalette> </format>

Re: colorpallette expression not matching field value

Richfez — Fri, 01 Mar 2024 21:37:35 GMT

What's the actual regex you are using to capture it?
And if you are sure you are using the right syntax because you copy pasted it from some working one - you could try to add | eval state = "up" as the last command in the search to force it to be "up" and see if that works. If it doesn't, then I'd say there's something else wrong with that syntax.

Re: colorpallette expression not matching field value

bowesmana — Sun, 03 Mar 2024 22:01:04 GMT

I don't believe you can use colour names, such as Green and Yellow, you have to use hex codes or RGB, see here

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML#Color_palette_types_and_options

in your case it's interesting that you have yellow, as I would expect black if it does not understand colour names.

Have you tried

<colorPalette type="expression">if(value == "up","#00FF00", "#FFFF00")</colorPalette>