topic Re: How to color a cell on dashboard based on condition when column names are dynamic? in Dashboards & Visualizations

How to color a cell on dashboard based on condition when column names are dynamic?

bhavlik — Wed, 28 Oct 2020 19:46:54 GMT

I have a table within a dashboard that is displaying information comparing event counts from a customer site to the event counts back here at corporate. The goal is to easily identify if corporate is missing any event data from the customer site. Here is a screenshot of the table:

I want to highlight any cells where "Missing=Yes" so it visually pops out to anyone viewing the dashboard. I found this post How-do-you-change-the-cell-color-based-on-partial-value but that solution is for columns whose name remain the same. In my table, the column names will change each day as the column names are the dates being displayed.

Is there a way to color a cell based on a condition when the column names are dynamic?

I also want to offer up that I am a beginner in Splunk and have no experience with using JavaScript or anything else besides Simple XML.

Thanks in advance for any suggestions.

Re: How to color a cell on dashboard based on condition when column names are dynamic?

ITWhisperer — Wed, 28 Oct 2020 23:01:59 GMT

If you don't specify a field name, it applies to the whole table, so try:

<format type="color"> <colorPalette type="expression">if(match(value,"Missing=Yes"),"#53A051",null)</colorPalette> </format>

Re: How to color a cell on dashboard based on condition when column names are dynamic?

bhavlik — Thu, 29 Oct 2020 15:12:20 GMT

Wow! That was so much easier than I thought! Thanks kind stranger.

Re: How to color a cell on dashboard based on condition when column names are dynamic?

a1bg503461 — Mon, 11 Nov 2024 15:08:20 GMT

Veryy helpful! Thx!

My case is with three conditions , can you help me color different cases as such please?

LogLevel : INFO -> Blue

LogLevel : WARRNING -> Yellow

LogLevel : Error -> Red

What I come up with is below but not working 😞

<format type="color"> <colorPalette type="expression"> if(match(value,"logLevel=INFO"),"#4f34eb",null), if(match(value,"logLevel=WARNING"),"#ffff00",null), if(match(value,"logLevel=ERROR"),"#53A051",null) </colorPalette> </format>

Re: How to color a cell on dashboard based on condition when column names are dynamic?

ITWhisperer — Mon, 11 Nov 2024 15:18:50 GMT

Try something like this

<format type="color"> <colorPalette type="expression"> case(match(value,"logLevel=INFO"),"#4f34eb",match(value,"logLevel=WARNING"),"#ffff00",match(value,"logLevel=ERROR"),"#53A051") </colorPalette> </format>

Re: How to color a cell on dashboard based on condition when column names are dynamic?

a1bg503461 — Mon, 11 Nov 2024 15:46:11 GMT

Sadly its still not working all is colored red as the last defined one:

Re: How to color a cell on dashboard based on condition when column names are dynamic?

bhavlik — Thu, 14 Nov 2024 17:30:59 GMT

Not sure if this will help but here's a couple things I noticed. In your original question, you have the word "Log" capitalized but in the syntax it is not. Could that be why it's not working? I also noticed that in your question the words "INFO" and "WARNING" are all capitalized but "Error" is not but you have it as "ERROR" in the syntax.

I often have spelling mistakes in my code that I don't catch right away so thought I'd offer that up as a suggestion. Good luck!