topic Re: How do you apply coloring based on a column value string to the complete row? in Splunk Search
https://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390557#M113742
<P>Although I cannot actually answer this question (and am not sure that it is possible with vanilla SimpleXML), I will contribute this helper non-answer for you and other potential answerers (that means you, @niketnilay). You can use this code to generate raw data:</P>
<PRE><CODE>| makeresults
| fields - _time
| eval XYZ="X Y Z"
| makemv XYZ
| mvexpand XYZ
| eval Context=mvrange(1,tonumber(case(XYZ=="X", "98", XYZ=="Y", "97", XYZ=="Z", "67")) + 1)
| mvexpand Context
| eval Context="ABC"
| append [
| makeresults
| fields - _time
| eval XYZ="X Y Z"
| makemv XYZ
| mvexpand XYZ
| eval Context=mvrange(1,tonumber(case(XYZ=="X", "50", XYZ=="Y", "45", XYZ=="Z", "23")) + 1)
| mvexpand Context
| eval Context="DEF" ]
| append [
| makeresults
| fields - _time
| eval XYZ="X Y Z"
| makemv XYZ
| mvexpand XYZ
| eval Context=mvrange(1,tonumber(case(XYZ=="X", "3", XYZ=="Y", "2", XYZ=="Z", "1")) + 1)
| mvexpand Context
| eval Context="GHI" ]
</CODE></PRE>
<P>Now look here, @bharathkumarnec, this pertains to you. You can build a <CODE>contingency table</CODE> out of this raw data with a single command by adding this:</P>
<PRE><CODE>| contingency Context XYZ
</CODE></PRE>
<P>Now you clever answerers have a starting point go answer this question!</P>
<P>One of the visualizations that is interesting for contingency tables is a stacked bar graph so please check out how that looks and if that is useful to you.</P>Sat, 06 Oct 2018 17:47:07 GMTwoodcock2018-10-06T17:47:07ZHow do you apply coloring based on a column value string to the complete row?
https://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390556#M113741
<P>Hi All,</P>
<PRE><CODE>Context X Y Z
ABC 98 97 67
DEF 50 45 23
GHI 3 2 1
</CODE></PRE>
<P>So, if Context is ABC, i have to apply color coding for X,Y,Z & if the context is DEF, another color coding need to be applied and so on.....</P>
<P>Also the X,Y&Z are not only three columns. i have "n" number of columns like that and sometimes these are dynamic and not static.</P>
<P>Regards,<BR />
BK</P>Mon, 24 Sep 2018 08:33:23 GMThttps://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390556#M113741bharathkumarnec2018-09-24T08:33:23ZRe: How do you apply coloring based on a column value string to the complete row?
https://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390557#M113742
<P>Although I cannot actually answer this question (and am not sure that it is possible with vanilla SimpleXML), I will contribute this helper non-answer for you and other potential answerers (that means you, @niketnilay). You can use this code to generate raw data:</P>
<PRE><CODE>| makeresults
| fields - _time
| eval XYZ="X Y Z"
| makemv XYZ
| mvexpand XYZ
| eval Context=mvrange(1,tonumber(case(XYZ=="X", "98", XYZ=="Y", "97", XYZ=="Z", "67")) + 1)
| mvexpand Context
| eval Context="ABC"
| append [
| makeresults
| fields - _time
| eval XYZ="X Y Z"
| makemv XYZ
| mvexpand XYZ
| eval Context=mvrange(1,tonumber(case(XYZ=="X", "50", XYZ=="Y", "45", XYZ=="Z", "23")) + 1)
| mvexpand Context
| eval Context="DEF" ]
| append [
| makeresults
| fields - _time
| eval XYZ="X Y Z"
| makemv XYZ
| mvexpand XYZ
| eval Context=mvrange(1,tonumber(case(XYZ=="X", "3", XYZ=="Y", "2", XYZ=="Z", "1")) + 1)
| mvexpand Context
| eval Context="GHI" ]
</CODE></PRE>
<P>Now look here, @bharathkumarnec, this pertains to you. You can build a <CODE>contingency table</CODE> out of this raw data with a single command by adding this:</P>
<PRE><CODE>| contingency Context XYZ
</CODE></PRE>
<P>Now you clever answerers have a starting point go answer this question!</P>
<P>One of the visualizations that is interesting for contingency tables is a stacked bar graph so please check out how that looks and if that is useful to you.</P>Sat, 06 Oct 2018 17:47:07 GMThttps://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390557#M113742woodcock2018-10-06T17:47:07ZRe: How do you apply coloring based on a column value string to the complete row?
https://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390558#M113743
<P>@bharathkumarnec adding more context to your question would assist us solve your problem.</P>
<P>If ABC, DEF, GHI etc. give the context for color to be applied what is the set of color to be applied for each?<BR />
If the number of columns X, Y and Z is not limited then would there be a scenario when you do not have actual color to be applied?<BR />
Can the same color from one series be applied to another series?</P>
<P>I would hope your option would be to use Simple XML JS Extension, whose complexity would be based on how you want to apply colors based on context.</P>Thu, 18 Oct 2018 13:57:47 GMThttps://community.splunk.com/t5/Splunk-Search/How-do-you-apply-coloring-based-on-a-column-value-string-to-the/m-p/390558#M113743niketnilay2018-10-18T13:57:47Z