topic Multiple different font colors in one cell / string in Splunk Search

Multiple different font colors in one cell / string

Cydraech — Tue, 14 Sep 2021 07:23:14 GMT

Hello people,

I'm very new to Splunk and I'm trying to create a dashboard with the "Statistics Table" Visualisation, that is more compact and takes up less space than what was there before.

In order to achieve this, I'm concatenating several strings from different fields, kind of like this:

| eval compactfield="1. ".field1."

2. ".field2."

3. ".field3

and while that looks fine and works, it'd be great if I could add some kind of color tag (or maybe even bold, italic and so on) so that there'd be a different color for each line, making it easier to differentiate for people looking at the dashboard. I'm imagining something like this:

| eval compactfield="<col="blue">1. ".field1."

</col><col="red">2. ".field2."

</col><col="purple">3. ".field3."</col>"

Is there a way to achieve this? I'm really sorry if this question has been asked before, but I couldn't find anything.

Thanks for your time,

Cyd

Re: Multiple different font colors in one cell / string

ITWhisperer — Tue, 14 Sep 2021 09:48:19 GMT

It can't be done with the standard table viz - you might be able to write some html panels but I suspect it would get overly complicated for little benefit.

Re: Multiple different font colors in one cell / string

Cydraech — Tue, 14 Sep 2021 10:07:54 GMT

Thanks for your answer!

I reckon that your assessment of the output not justifying the input is right. If there's no quicker way to do it, then - especially as a beginner - I don't think I should waste any more time on it. Maybe I'll revisit this later down the line, who knows.

Re: Multiple different font colors in one cell / string

ITWhisperer — Tue, 14 Sep 2021 12:54:02 GMT

There is potential for using CSS to style your cells, e.g. background colour based on the content of the field. If you use multi-value fields, you could also hide (display: none;) on some of the multi-value indexes.