topic Re: SPL dynamic range in Dashboards & Visualizations

SPL dynamic range

asabatini — Fri, 06 Sep 2024 16:13:42 GMT

Hi folks,

I have a quick question based on this kind of data.

consider this table

Age sex id ^N-S-Ba S-N mm 17 male 1 125 84 17 female 2 133 75

I have to create a dynamic range for the field "S-N mm"
for the female is from 74,6 to 77

for the male is from 79,3 to 87,7
I need to create a table that when one of these values is within range it should turn green

thanks for the support

Ale

Re: SPL dynamic range

bowesmana — Fri, 06 Sep 2024 16:28:35 GMT

I'm assuming this is in a dashboard.

If you are using simple XML you can do this using the technique described in these links below. As you need to colour the cell based on dependency of data elsewhere (male/female) you need to calculate the colour you want in the SPL and then make the S-N mm field a multivalue field and then use the expression type of syntax.

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-color-of-row-based-on-cell-value-in-splunk/m-p/525471/highlight/true#M35637

https://community.splunk.com/t5/Dashboards-Visualizations/Changing-the-color-of-a-table-row-if-the-response-time-is/m-p/678151/highlight/true#M55537

https://community.splunk.com/t5/Dashboards-Visualizations/How-color-a-field-by-other-value-in-XML/m-p/671094/highlight/true#M54930

Re: SPL dynamic range

asabatini — Fri, 06 Sep 2024 21:03:34 GMT

Hi @bowesmana

I tried our suggestion but doesn't works maybe I wrong something?

<dashboard version="1.1" theme="light"> <label>ID patient</label> <row> <panel> <html depends="$hidden$"> <style> #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="0"]{ display: none; } </style> </html> <table id="coloured_cell"> <search> <query>sourcetype=csv | eval value=mvappend(sex,'S_N mm') | table Age id sex "S_N mm" N_S_Ba value</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="id"></format> <format type="color" field="value"> <colorPalette type="expression">case(mvindex(value, 1) >"79" AND mvindex(value, 0) == "male","#00FF00")</colorPalette> </format> </table> </panel> </row> </dashboard>

Re: SPL dynamic range

ITWhisperer — Sat, 07 Sep 2024 09:23:36 GMT

As @bowesmana said (and does the articles he referenced, and many others on this subject), your calculation to determine the colour should be done in SPL, so try modifying your search accordingly.

Re: SPL dynamic range

asabatini — Sat, 07 Sep 2024 11:23:51 GMT

Hi @bowesmana , @ITWhisperer ,

Ok this method works fine, I'll explain what I did.

first I created a multivalue field with "sex, and S_n_mm" fields.

| eval value=mvappend(sex,'S_N mm')

after this I created the condition directly on the XML code dashboard.

<format type="color" field="value"> <colorPalette type="expression">case(mvindex(value, 1) >"79" AND mvindex(value, 0) == "male","#00FF00",mvindex(value, 1) >"74" AND mvindex(value, 0) == "female","#00FF00")</colorPalette> </format>