topic Re: How to highlight table cell based on few conditions? in Splunk Search

How to highlight table cell based on few conditions?

sarit_s — Wed, 30 Sep 2020 00:18:46 GMT

Hello
i have a table with multiple fields but i want to highlight only few of them based on some conditions:
the relevant columns are :
HeadVoltage, Voltage_before_optimization, Layer
i want to highlight them if Layer<=26 and (HeadVoltage>=29 OR Voltage_before_optimization>=29)
**the numbers in those fields are float
i want to have only severe (red) color

this is my js file:

 /* TODO: jink to replace theme_utils with that from core */
require.config({
  paths: {
    theme_utils: '../app/simple_xml_examples/theme_utils'
  }
});
require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'theme_utils',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, themeUtils) {

     // Row Coloring Example with custom, client-side range interpretation

    var isDarkTheme = themeUtils.getCurrentTheme && themeUtils.getCurrentTheme() === 'dark';

    var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
        canRender: function(cell) {
            // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field
            return _(['HeadVoltage', 'Voltage_before_optimization','Layer']).contains(cell.field);
        },
        render: function($td, cell) {
            // Add a class to the cell based on the returned value
            var value = parseFloat(cell.value);

            // Apply interpretation for number of historical searches

          if (cell.field === 'HeadVoltage' || cell.field === 'Voltage_before_optimization') {
                if (value >= 29) {
                        if (cell.field === 'Layer') {
                                if (value <= 26) {
                                    $td.addClass('range-cell').addClass('range-severe');
                                                }
                        }
                }
               // else if (value > 1) {
                //    $td.addClass('range-cell').addClass('range-elevated');
                //}
                else if (value < 29) {
                    $td.addClass('range-cell').addClass('range-low');
                }
            }

            // Apply interpretation for number of realtime searches
            //if (cell.field === 'active_realtime_searches') {
             //   if (value > 1) {
              //      $td.addClass('range-cell').addClass('range-severe');
               // }
//            }
                   if (cell.field === 'HeadVoltage' || cell.field === 'Voltage_before_optimization') {
                if (value >= 29) {
                        if (cell.field === 'Layer') {
                                if (value <= 26) {
                                    $td.addClass('range-cell').addClass('range-severe');
                                                }
                        }
                }


            if (isDarkTheme) {
              $td.addClass('dark');
            }

            // Update the cell content
            $td.text(value.toFixed(2)).addClass('numeric');
        }
    });

    mvc.Components.get('highlight').getVisualization(function(tableView) {
        // Add custom cell renderer, the table will re-render automatically.
        tableView.addCellRenderer(new CustomRangeRenderer());
    });

});

my css file:

  /* Cell Highlighting */
    /* 
    #highlight td {
        background-color: #c1ffc3 !important;
    }
    */
    #highlight td.range-low {
        color: #C0D9D9;
    }
    #highlight td.range-elevated {
        background-color: #ffc57a !important;
        font-weight: bold;
    }
    #highlight td.range-severe {
        background-color: #d59392 !important;
        font-weight: bold;
    }
    /* Dark Theme */
    #highlight td.dark {
        color: #F2F4F5;
    }
    #highlight td.range-low.dark {
        color: #006D9C;
    }
    #highlight td.range-elevated.dark {
        background-color: #EC9960 !important;
        font-weight: bold;
    }
    #highlight td.range-severe.dark {
        background-color: #AF575A !important;
        font-weight: bold;
    }

my first line in xml :

   <dashboard script="table_cell_highlighting.js" stylesheet="table_cell_highlighting.css">

it is not working. what am i missing ?

Re: How to highlight table cell based on few conditions?

sarit_s — Tue, 30 Apr 2019 20:47:31 GMT

any idea anyone ?

i guess the problem is with the multiple conditions because if im running for only one of the fields each time it is working

but i need that it will color the field only if it match both conditions..

Re: How to highlight table cell based on few conditions?

adonio — Wed, 01 May 2019 02:33:16 GMT

checkout this example:
https://answers.splunk.com/answers/742882/color-rows-based-on-two-fields-conditions.html

overall, id go with creating a new field
... your search ... | eval highlight = if(Layer<=26 and (HeadVoltage>=29 OR Voltage_before_optimization>=29),1,0)

run this search anywhere, save as dashboard panel. and add the relevant lines to the xml code under the <table> attribute / element:

| makeresults count=1
| eval appliances = "oven,microwave,dishwasher,laundry machine, dryer"
| makemv delim="," appliances
| mvexpand appliances
| eval Layer = random()%40
| eval HeadVoltage = random()%50
| eval Voltage_before_optimization = random()%60
| eval highlight = if(Layer<=26 and (HeadVoltage>=29 OR Voltage_before_optimization>=29),1,0)
| table appliances Layer HeadVoltage Voltage_before_optimization highlight

and add the relevant lines to the xml code under the <table> attribute / element:

<format type="color" field="highlight">
           <colorPalette type="map">{"0":#00FF3E,"1":#FF5733}</colorPalette>
         </format>

hope it helps

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 30 Sep 2020 00:19:10 GMT

hi
thanks !
it is highlight the highlight column but there are few issues:
1. i don't want it to highligh seperate column but the "layer", "head voltage" and "Voltage_before_optimization" columns
2. it highlights the highlight column but not at the right places..

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 01 May 2019 05:17:03 GMT

@sarit_s

Check out this. The trick might be useful to you.

https://answers.splunk.com/answers/661894/how-to-color-cell-contents-with-css-and-js.html

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 30 Sep 2020 00:19:13 GMT

hi
thanks for your reply..
it is not what im looking for
my problem is that i have few conditions that should happen before coloring and i think that i wrote it in the js script incorrectly

i will try to explain it better:
i have 3 fields
Layer, HeadVoltage, Voltage_before_optimization
i need to check if (HeadVoltage > 29 OR Voltage_before_optimization > 29 ) and (Layer < 26)
then
color the relevant cells in red (ie HeadVoltage and Latey or Voltage_before_optimization and Layer)

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 30 Sep 2020 00:19:16 GMT

@sarit_s
Is the cell colour of Layer, HeadVoltage and Voltage_before_optimization is depends on the value of other cells? like does Layer is depending on HeadVoltage or Voltage_before_optimization?

AND

Have you tried with separating conditions in js?

if (cell.field === 'HeadVoltage' & value >= 29) {
         $td.addClass('range-cell').addClass('range-severe');
}

if (cell.field === 'Voltage_before_optimization' & value >= 29) {
         $td.addClass('range-cell').addClass('range-severe');
}

if (cell.field === 'Layer' & value < 26) {
         $td.addClass('range-cell').addClass('range-severe');
}

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 01 May 2019 07:00:38 GMT

hi
the cell coloring depends only on the value of those fields
it should be colored only if both conditions are happening
so if Layer < 26 and HeadVoltage >29 for example then both Layer and HeadVoltage should be red

i tried the example you posted but it is coloring the cells if one of the conditions are true

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 30 Sep 2020 00:19:19 GMT

i think that the problem is that the JS don't know which cell to color..

the condition is :
if ((cell.field === 'Voltage_before_optimization' && value > 29)) && (cell.field === 'Layer' && value1 < 26)) {

                        $td.addClass('range-cell').addClass('range-severe');

}
                        else if (( cell.field === 'HeadVoltage' && value > 29) && (cell.field === 'Layer' && value1 < 26)) {
                            {

                              $td.addClass('range-cell').addClass('range-severe');
                }
            }
}

and i think that since the condition contains 3 cells it failed..

what do you think ?

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 30 Sep 2020 00:19:22 GMT

@sarit_s

Can you please try this Dashboard code? Here I have shared scenario specific code. I have made trick in search and used in javascript. Try and let me know if any issue.

table_cell_highlighting.css

#highlight div.range-severe {
 background-color: #d59392 !important;
 font-weight: bold;
}

table_cell_highlighting.js

require([
     'underscore',
     'jquery',
     'splunkjs/mvc',
     'splunkjs/mvc/tableview',
     'splunkjs/mvc/simplexml/ready!'
 ], function(_, $, mvc, TableView) {

     var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
         canRender: function(cell) {
             return _(['HeadVoltage', 'Voltage_before_optimization', 'Layer']).contains(cell.field);
         },
         render: function($td, cell) {
            var cell_value = cell.value;
            var HeadVoltage = cell_value.split("|")[0];
            var Voltage_before_optimization = cell_value.split("|")[1];
            var Layer = cell_value.split("|")[2];           
            if (HeadVoltage > 29 && Layer > 26)
            {
                if (cell.field === 'HeadVoltage'){
                    $td.html("<div class='range-severe'>"+HeadVoltage+"</div>")
                } else if(cell.field === 'Voltage_before_optimization') {
                    $td.html("<div>"+Voltage_before_optimization+"</div>")
                } else if(cell.field === 'Layer') {
                    $td.html("<div class='range-severe'>"+Layer+"</div>")
                }
            }
         }
     });

     //List of table IDs to add icon
     var tableIDs = ["highlight"];
     for (i=0;i<tableIDs.length;i++) {
         var sh = mvc.Components.get(tableIDs[i]);
         if(typeof(sh)!="undefined") {
             sh.getVisualization(function(tableView) {
                 // Add custom cell renderer and force re-render
                 tableView.table.addCellRenderer(new CustomRangeRenderer());
                 tableView.table.render();
             });
         }
     }    
 });

XML

<dashboard script="table_cell_highlighting.js" stylesheet="table_cell_highlighting.css">
  <label>Cell Color on the based of other cells</label>
  <row>
    <panel>
      <table id="highlight">
        <search>
          <query>| makeresults | eval HeadVoltage=31, Voltage_before_optimization=30, Layer=27 | eval temp=HeadVoltage."|".Voltage_before_optimization."|".Layer,HeadVoltage=temp, Voltage_before_optimization=temp, Layer=temp  | table HeadVoltage Voltage_before_optimization Layer</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 01 May 2019 10:23:35 GMT

nothing happens 😞

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 01 May 2019 10:30:56 GMT

@sarit_s

Can you please share your code which you have tried?

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 01 May 2019 10:41:40 GMT

js file :

 require([
      'underscore',
      'jquery',
      'splunkjs/mvc',
      'splunkjs/mvc/tableview',
      'splunkjs/mvc/simplexml/ready!'
  ], function(_, $, mvc, TableView) {

      var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
          canRender: function(cell) {
              return _(['HeadVoltage', 'Voltage_before_optimization', 'Layer']).contains(cell.field);
          },
          render: function($td, cell) {
             var cell_value = cell.value;
             var HeadVoltage = cell_value.split("|")[0];
             var Voltage_before_optimization = cell_value.split("|")[1];
             var Layer = cell_value.split("|")[2];
             if ((HeadVoltage > 29 OR Voltage_before_optimization > 29 ) && Layer < 26)
             {
                 if (cell.field === 'HeadVoltage'){
                     $td.html("<div class='range-severe'>"+HeadVoltage+"</div>")
                 } else if(cell.field === 'Voltage_before_optimization') {
                     $td.html("<div>"+Voltage_before_optimization+"</div>")
                 } else if(cell.field === 'Layer') {
                     $td.html("<div class='range-severe'>"+Layer+"</div>")
                 }
             }
          }
      });

      //List of table IDs to add icon
      var tableIDs = ["highlight"];
      for (i=0;i<tableIDs.length;i++) {
          var sh = mvc.Components.get(tableIDs[i]);
          if(typeof(sh)!="undefined") {
              sh.getVisualization(function(tableView) {
                  // Add custom cell renderer and force re-render
                  tableView.table.addCellRenderer(new CustomRangeRenderer());
                  tableView.table.render();
              });
          }
      }
  });

css:

 #highlight div.range-severe {
  background-color: #d59392 !important;
  font-weight: bold;
 }

xml:

<form script="table_cell_highlighting2.js" stylesheet="table_cell_highlighting2.css">
  <label>PJ J7 Heads Monitoring</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="SerialNumber">
      <label>SerialNumber</label>
      <default>*</default>
    </input>
    <input type="text" token="HeadSerialNumber">
      <label>HeadSerialNumber</label>
      <default>*</default>
    </input>
    <input type="text" token="Region">
      <label>Region</label>
      <default>*</default>
    </input>
    <input type="text" token="HeadType">
      <label>HeadType</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table id="highlight">
        <search>
          <query>(index=*_pj OR index=other) NOT source=*Bio_Mimics* 
(Head Optimization Wizard ((started) OR (ended) OR (was selected) OR (num of missing) OR (Save voltage) OR (Support voltage) OR (Model voltage) OR (Target layer Net))) OR
(("Serial Number") OR ("Head Type") OR ("Maintenance counter"))
|`SerialNumber`
| search SerialNumber=$SerialNumber$
|`Region`
| search Region=$Region$
|`PrinterType`
| rex "Serial Number = (?&lt;HeadSerialNumber&gt;\S+)"
| rex field=HeadSerialNumber mode=sed "s/,//"
| rex "Head Type = (?&lt;HeadType&gt;[\w\ ]+)"
| rex "Head Optimization Wizard: (?&lt;WizardMode&gt;\S+) was selected"
| rex "Nozzles for head Head (?&lt;head&gt;\d+) is (?&lt;missing_nozzles&gt;\d+)"
| rex "physical Head Index = (?&lt;head&gt;\d+)"
| rex "Save voltage (?&lt;Calibrated_voltage&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
| rex "Support voltage (?&lt;Voltage_before_optimization&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
| rex "Model voltage (?&lt;Voltage_before_optimization&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
| rex "Head Optimization Wizard: (?&lt;wizard_ended&gt;ended)"
| rex "Head Optimization Wizard: (?&lt;wizard_started&gt;started)"
| rex "Target layer Net\s+\=\s+(?&lt;Layer&gt;[\d\.]+)"
| eval startedTime=if(isnotnull(wizard_started),_time,null())
| eval startedSource=if(isnotnull(wizard_started),source,null())
| eval endedTime=if(isnotnull(wizard_ended),_time,null())
| eval endedSource=if(isnotnull(wizard_ended),source,null())
| rex "Maintenance counter \"H(?&lt;head&gt;\d+)\" Value is: (?&lt;head_lifetime&gt;\d+)"
| eventstats max(startedTime) as startedTime max(endedTime) as endedTime by SerialNumber
| where isnotnull(HeadSerialNumber) OR isnotnull(HeadType) OR (_time&gt;=startedTime AND _time&lt;=endedTime)
| sort 0 _time 
| streamstats last(Layer) as Layer  last(WizardMode) as WizardMode last(startedTime) as startedTime last(startedSource) as startedSource last(endedTime) as endedTime last(endedSource) as endedSource by SerialNumber
| stats last(endedSource) as endedSource last(startedSource) as startedSource max(startedTime) as startedTime max(endedTime) as endedTime last(*) as * by SerialNumber head
| search HeadSerialNumber=$HeadSerialNumber$ HeadType=$HeadType$
| lookup internal_Printers SN as SerialNumber OUTPUT  Type
| eval Internal=if(isnotnull(Type),"T","F")
| table startedTime endedTime Region Internal SerialNumber PrinterType head HeadSerialNumber HeadType missing_nozzles HeadVoltage HeadVoltageDate  Voltage_before_optimization Calibrated_voltage head_lifetime Layer WizardMode startedSource endedSource
| rename Calibrated_voltage as Calibrated_voltage_after_optimization

| join type=left Region SerialNumber MachineMode head 
    [search (index=*_pj OR index=other) source=*HQ.cfg OR source=*HM.cfg AND (RequestedHeadVoltagesSupport OR RequestedHeadVoltagesModel )
| `SerialNumber`
|`Region`
| rex field=source "PerMachine_(?&lt;WizardMode&gt;[^\.]+)" 
| eval WizardMode=if(WizardMode=="HM","HS/HM",WizardMode) 
| rex "RequestedHeadVoltagesSupport=(?&lt;head0&gt;[^,]+),(?&lt;head1&gt;[^,]+)," 
| rex "RequestedHeadVoltagesModel=[^,]+,[^,]+,(?&lt;head2&gt;[^,]+),(?&lt;head3&gt;[^,]+),(?&lt;head4&gt;[^,]+),(?&lt;head5&gt;[^,]+),(?&lt;head6&gt;[^,]+),(?&lt;head7&gt;[^,]+)"
| stats latest(*) as * max(_time) as headVoltageDate by SerialNumber Region
| table HeadVoltageDate Region SerialNumber WizardMode head*
| eval id=Region+"@"+SerialNumber+"@"+WizardMode+"@"+headVoltageDate
| table id head* 
| rename head* as *
| untable id head HeadVoltage
| eval id=split(id,"@")
| eval Region=mvindex(id,0)
| eval SerialNumber=mvindex(id,1)
| eval WizardMode=mvindex(id,2)
| eval HeadVoltageDate=mvindex(id,3)

| table  Region SerialNumber WizardMode head HeadVoltage HeadVoltageDate]
| convert ctime(endedTime) ctime(startedTime) ctime(HeadVoltageDate) timeformat="%F %T"</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 01 May 2019 11:02:19 GMT

@sarit_s

Can you please add below search into table search and try again?

SEARCH IN XML | eval temp=HeadVoltage."|".Voltage_before_optimization."|".Layer,HeadVoltage=temp, Voltage_before_optimization=temp, Layer=temp | fields - temp

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 01 May 2019 11:07:35 GMT

this is my new xml:

<form script="table_cell_highlighting2.js" stylesheet="table_cell_highlighting2.css">
  <label>PJ J7 Heads Monitoring</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="SerialNumber">
      <label>SerialNumber</label>
      <default>*</default>
    </input>
    <input type="text" token="HeadSerialNumber">
      <label>HeadSerialNumber</label>
      <default>*</default>
    </input>
    <input type="text" token="Region">
      <label>Region</label>
      <default>*</default>
    </input>
    <input type="text" token="HeadType">
      <label>HeadType</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table id="highlight">
        <search>
          <query>(index=*_pj OR index=other) NOT source=*Bio_Mimics* 
(Head Optimization Wizard ((started) OR (ended) OR (was selected) OR (num of missing) OR (Save voltage) OR (Support voltage) OR (Model voltage) OR (Target layer Net))) OR
(("Serial Number") OR ("Head Type") OR ("Maintenance counter"))
|`SerialNumber`
| search SerialNumber=$SerialNumber$
|`Region`
| search Region=$Region$
|`PrinterType`
| rex "Serial Number = (?&lt;HeadSerialNumber&gt;\S+)"
| rex field=HeadSerialNumber mode=sed "s/,//"
| rex "Head Type = (?&lt;HeadType&gt;[\w\ ]+)"
| rex "Head Optimization Wizard: (?&lt;WizardMode&gt;\S+) was selected"
| rex "Nozzles for head Head (?&lt;head&gt;\d+) is (?&lt;missing_nozzles&gt;\d+)"
| rex "physical Head Index = (?&lt;head&gt;\d+)"
| rex "Save voltage (?&lt;Calibrated_voltage&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
| rex "Support voltage (?&lt;Voltage_before_optimization&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
| rex "Model voltage (?&lt;Voltage_before_optimization&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
| rex "Head Optimization Wizard: (?&lt;wizard_ended&gt;ended)"
| rex "Head Optimization Wizard: (?&lt;wizard_started&gt;started)"
| rex "Target layer Net\s+\=\s+(?&lt;Layer&gt;[\d\.]+)"
| eval startedTime=if(isnotnull(wizard_started),_time,null())
| eval startedSource=if(isnotnull(wizard_started),source,null())
| eval endedTime=if(isnotnull(wizard_ended),_time,null())
| eval endedSource=if(isnotnull(wizard_ended),source,null())
| rex "Maintenance counter \"H(?&lt;head&gt;\d+)\" Value is: (?&lt;head_lifetime&gt;\d+)"
| eventstats max(startedTime) as startedTime max(endedTime) as endedTime by SerialNumber
| where isnotnull(HeadSerialNumber) OR isnotnull(HeadType) OR (_time&gt;=startedTime AND _time&lt;=endedTime)
| sort 0 _time 
| streamstats last(Layer) as Layer  last(WizardMode) as WizardMode last(startedTime) as startedTime last(startedSource) as startedSource last(endedTime) as endedTime last(endedSource) as endedSource by SerialNumber
| stats last(endedSource) as endedSource last(startedSource) as startedSource max(startedTime) as startedTime max(endedTime) as endedTime last(*) as * by SerialNumber head
| search HeadSerialNumber=$HeadSerialNumber$ HeadType=$HeadType$
| lookup internal_Printers SN as SerialNumber OUTPUT  Type
| eval Internal=if(isnotnull(Type),"T","F")
| table startedTime endedTime Region Internal SerialNumber PrinterType head HeadSerialNumber HeadType missing_nozzles HeadVoltage HeadVoltageDate  Voltage_before_optimization Calibrated_voltage head_lifetime Layer WizardMode startedSource endedSource
| rename Calibrated_voltage as Calibrated_voltage_after_optimization

| join type=left Region SerialNumber MachineMode head 
    [search (index=*_pj OR index=other) source=*HQ.cfg OR source=*HM.cfg AND (RequestedHeadVoltagesSupport OR RequestedHeadVoltagesModel )
| `SerialNumber`
|`Region`
| rex field=source "PerMachine_(?&lt;WizardMode&gt;[^\.]+)" 
| eval WizardMode=if(WizardMode=="HM","HS/HM",WizardMode) 
| rex "RequestedHeadVoltagesSupport=(?&lt;head0&gt;[^,]+),(?&lt;head1&gt;[^,]+)," 
| rex "RequestedHeadVoltagesModel=[^,]+,[^,]+,(?&lt;head2&gt;[^,]+),(?&lt;head3&gt;[^,]+),(?&lt;head4&gt;[^,]+),(?&lt;head5&gt;[^,]+),(?&lt;head6&gt;[^,]+),(?&lt;head7&gt;[^,]+)"
| stats latest(*) as * max(_time) as headVoltageDate by SerialNumber Region
| table HeadVoltageDate Region SerialNumber WizardMode head*
| eval id=Region+"@"+SerialNumber+"@"+WizardMode+"@"+headVoltageDate
| table id head* 
| rename head* as *
| untable id head HeadVoltage
| eval id=split(id,"@")
| eval Region=mvindex(id,0)
| eval SerialNumber=mvindex(id,1)
| eval WizardMode=mvindex(id,2)
| eval HeadVoltageDate=mvindex(id,3)
| eval temp=HeadVoltage."|".Voltage_before_optimization."|".Layer,HeadVoltage=temp, Voltage_before_optimization=temp, Layer=temp | fields - temp
| table  Region SerialNumber WizardMode head HeadVoltage HeadVoltageDate]
| convert ctime(endedTime) ctime(startedTime) ctime(HeadVoltageDate) timeformat="%F %T"</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

nothing happens and i lost data from HeadVoltage 😕

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 01 May 2019 11:33:24 GMT

Query should be like this.

 <query>(index=*_pj OR index=other) NOT source=*Bio_Mimics* 
 (Head Optimization Wizard ((started) OR (ended) OR (was selected) OR (num of missing) OR (Save voltage) OR (Support voltage) OR (Model voltage) OR (Target layer Net))) OR
 (("Serial Number") OR ("Head Type") OR ("Maintenance counter"))
 |`SerialNumber`
 | search SerialNumber=$SerialNumber$
 |`Region`
 | search Region=$Region$
 |`PrinterType`
 | rex "Serial Number = (?&lt;HeadSerialNumber&gt;\S+)"
 | rex field=HeadSerialNumber mode=sed "s/,//"
 | rex "Head Type = (?&lt;HeadType&gt;[\w\ ]+)"
 | rex "Head Optimization Wizard: (?&lt;WizardMode&gt;\S+) was selected"
 | rex "Nozzles for head Head (?&lt;head&gt;\d+) is (?&lt;missing_nozzles&gt;\d+)"
 | rex "physical Head Index = (?&lt;head&gt;\d+)"
 | rex "Save voltage (?&lt;Calibrated_voltage&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
 | rex "Support voltage (?&lt;Voltage_before_optimization&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
 | rex "Model voltage (?&lt;Voltage_before_optimization&gt;[\d\.]+) for head Head (?&lt;head&gt;\d+)"
 | rex "Head Optimization Wizard: (?&lt;wizard_ended&gt;ended)"
 | rex "Head Optimization Wizard: (?&lt;wizard_started&gt;started)"
 | rex "Target layer Net\s+\=\s+(?&lt;Layer&gt;[\d\.]+)"
 | eval startedTime=if(isnotnull(wizard_started),_time,null())
 | eval startedSource=if(isnotnull(wizard_started),source,null())
 | eval endedTime=if(isnotnull(wizard_ended),_time,null())
 | eval endedSource=if(isnotnull(wizard_ended),source,null())
 | rex "Maintenance counter \"H(?&lt;head&gt;\d+)\" Value is: (?&lt;head_lifetime&gt;\d+)"
 | eventstats max(startedTime) as startedTime max(endedTime) as endedTime by SerialNumber
 | where isnotnull(HeadSerialNumber) OR isnotnull(HeadType) OR (_time&gt;=startedTime AND _time&lt;=endedTime)
 | sort 0 _time 
 | streamstats last(Layer) as Layer  last(WizardMode) as WizardMode last(startedTime) as startedTime last(startedSource) as startedSource last(endedTime) as endedTime last(endedSource) as endedSource by SerialNumber
 | stats last(endedSource) as endedSource last(startedSource) as startedSource max(startedTime) as startedTime max(endedTime) as endedTime last(*) as * by SerialNumber head
 | search HeadSerialNumber=$HeadSerialNumber$ HeadType=$HeadType$
 | lookup internal_Printers SN as SerialNumber OUTPUT  Type
 | eval Internal=if(isnotnull(Type),"T","F")
 | table startedTime endedTime Region Internal SerialNumber PrinterType head HeadSerialNumber HeadType missing_nozzles HeadVoltage HeadVoltageDate  Voltage_before_optimization Calibrated_voltage head_lifetime Layer WizardMode startedSource endedSource
 | rename Calibrated_voltage as Calibrated_voltage_after_optimization

 | join type=left Region SerialNumber MachineMode head 
     [search (index=*_pj OR index=other) source=*HQ.cfg OR source=*HM.cfg AND (RequestedHeadVoltagesSupport OR RequestedHeadVoltagesModel )
 | `SerialNumber`
 |`Region`
 | rex field=source "PerMachine_(?&lt;WizardMode&gt;[^\.]+)" 
 | eval WizardMode=if(WizardMode=="HM","HS/HM",WizardMode) 
 | rex "RequestedHeadVoltagesSupport=(?&lt;head0&gt;[^,]+),(?&lt;head1&gt;[^,]+)," 
 | rex "RequestedHeadVoltagesModel=[^,]+,[^,]+,(?&lt;head2&gt;[^,]+),(?&lt;head3&gt;[^,]+),(?&lt;head4&gt;[^,]+),(?&lt;head5&gt;[^,]+),(?&lt;head6&gt;[^,]+),(?&lt;head7&gt;[^,]+)"
 | stats latest(*) as * max(_time) as headVoltageDate by SerialNumber Region
 | table HeadVoltageDate Region SerialNumber WizardMode head*
 | eval id=Region+"@"+SerialNumber+"@"+WizardMode+"@"+headVoltageDate
 | table id head* 
 | rename head* as *
 | untable id head HeadVoltage
 | eval id=split(id,"@")
 | eval Region=mvindex(id,0)
 | eval SerialNumber=mvindex(id,1)
 | eval WizardMode=mvindex(id,2)
 | eval HeadVoltageDate=mvindex(id,3)
 | table  Region SerialNumber WizardMode head HeadVoltage HeadVoltageDate]
 | convert ctime(endedTime) ctime(startedTime) ctime(HeadVoltageDate) timeformat="%F %T"
| eval temp=HeadVoltage."|".Voltage_before_optimization."|".Layer,HeadVoltage=temp, Voltage_before_optimization=temp, Layer=temp | fields - temp </query>

Re: How to highlight table cell based on few conditions?

sarit_s — Wed, 01 May 2019 12:01:17 GMT

it returns the values in the relevant field with | delimiter
not coloring anything and merge field results..

Re: How to highlight table cell based on few conditions?

kamlesh_vaghela — Wed, 01 May 2019 12:09:15 GMT

Merging fields is expected. Can you please pul some consoles in javascript in render function??

console.log(" some console log");

I hope you are _bump the version on your Splunk instance. 🙂

Basically, render function should work properly and display specific value along with the colour. 🙂

Re: How to highlight table cell based on few conditions?

dailv1808 — Fri, 23 Aug 2019 07:55:25 GMT

i have same problem. Anyone Tell me if it solved.