Specific keyword based colour

jerinvarghese — Tue, 20 Oct 2020 14:00:26 GMT

Hi Team,

need help in getting few nodelabel highlighted. "WANRT" & "DCNDC".

sitecode	nodelabel
PJS	LANCUA001
PCW	LANCUA001
PCW	WANINF001
PCW	WANRTC001
PCW	DCNDCI001

Below is the code that I used to get the "WANRT" devices highlighted with RED color, but i am unable to get the "DCNDC" devices too.

<format type="color" field="nodelabel"> <colorPalette type="expression">if (like(value,"%WANRT%"),"#FF5733","#FFFFFF")</colorPalette> </format>

please help me with the code to get both highlighted.

Re: Specific keyword based colour

richgalloway — Tue, 20 Oct 2020 14:50:22 GMT

Have you tried this?

<format type="color" field="nodelabel"> <colorPalette type="expression"> if (like(value,"%WANRT%") OR like(value, "DCNDC%"),"#FF5733","#FFFFFF")</colorPalette> </format>

topic Specific keyword based colour in Splunk Search

Specific keyword based colour

Re: Specific keyword based colour