topic Re: Can i assign a color to a string in a field if it is present in the field ? in Splunk Search

Can i assign a color to a string in a field if it is present in the field ?

varun99 — Thu, 08 Feb 2018 05:38:13 GMT

My requirement is to highlight the "Error" string in red colour if it is present in the extracted field "Status".
Note: I am using stats command.

Re: Can i assign a color to a string in a field if it is present in the field ?

493669 — Thu, 08 Feb 2018 05:43:04 GMT

You can do this by adding this format:

<format type="color" field="Status">
          <colorPalette type="map">{"ERROR":#D93F3C}</colorPalette>
 </format>

try this run anywhere search:

<dashboard>
  <label>error</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by log_level</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="log_level">
          <colorPalette type="map">{"ERROR":#D93F3C}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

Re: Can i assign a color to a string in a field if it is present in the field ?

varun99 — Thu, 08 Feb 2018 05:54:22 GMT

Already tried this, but it's not working. Please note that the Status field contains a big string like :
"Request received. Sent to Provider. Error. Received response from Provider."
"Error" is just a part of the string.

Re: Can i assign a color to a string in a field if it is present in the field ?

493669 — Thu, 08 Feb 2018 06:39:50 GMT

its possible with the help of js
have a look at https://answers.splunk.com/answers/42994/advanced-xml-highlight-certain-values-in-a-table-not-numerical.html

Re: Can i assign a color to a string in a field if it is present in the field ?

varun99 — Thu, 08 Feb 2018 06:52:49 GMT

Worked with the below:

if (like(value,"%Error%"),"#FF5733","#247bc1")

Thanks anyways 🙂

Re: Can i assign a color to a string in a field if it is present in the field ?

varun99 — Thu, 08 Feb 2018 06:53:25 GMT

Worked with the below:

    <format type="color" field="Status">
      <colorPalette type="expression">if (like(value,"%Error%"),"#FF5733","#247bc1")</colorPalette>
    </format>

Re: Can i assign a color to a string in a field if it is present in the field ?

493669 — Thu, 08 Feb 2018 06:57:37 GMT

great! 🙂

Re: Can i assign a color to a string in a field if it is present in the field ?

markhill1 — Sat, 14 Apr 2018 08:22:53 GMT

Is it possible to add in more values? Ive tried a few combinations of syntax and havent got it working yet.
Thanks.
Worked it out:

      <colorPalette type="expression">if (like(value,"%host%") OR like(value,"%feed%"),"#D93F3C","#FFFFFF")</colorPalette>
    </format>

Re: Can i assign a color to a string in a field if it is present in the field ?

niketn — Sat, 14 Apr 2018 09:50:20 GMT

Refer to one of my previous answers on similar lines. Changes can be made to Javascript to apply color/background color to complete text

https://answers.splunk.com/answers/636948/how-to-add-css-class-to-table-field-by-input-in-sp.html
Please see if it fits the need.

Re: Can i assign a color to a string in a field if it is present in the field ?

niketn — Sat, 04 Aug 2018 18:25:22 GMT

Refer to comment by @TonyLeeVT where multiple nested if can be used to set more than two color values using colorPalette type as expression https://answers.splunk.com/answers/26522/if-statment-or-nested-if.html#comment-677995

Re: Can i assign a color to a string in a field if it is present in the field ?

askkawalkar — Fri, 05 Apr 2019 07:08:13 GMT

It can be achieve using case also - I have used case, Thanks to @varun99 for providing concept.

<format type="color" field="status">
          <colorPalette type="expression">case(like(value,"ok"),"#53A051",like(value,"warn"),"#F8BE34", !like(value,"ok"),"#DC4E41")</colorPalette>
        </format>

Re: Can i assign a color to a string in a field if it is present in the field ?

niketn — Sat, 25 Apr 2020 16:56:06 GMT

Yes seems like case works in Splunk 8.x. Not sure which version onward it started working.

Re: Can i assign a color to a string in a field if it is present in the field ?

nsaveljevas — Thu, 31 Oct 2024 23:43:25 GMT

It was worked to me! Thanks a lot! 😄