topic Re: Using wild card in table column formating in Splunk Search

Using wild card in table column formating

splunkuser320 — Fri, 02 Dec 2022 16:40:37 GMT

I want to change the column cell background based on the value, but I also want to use a wild card.

Example Field values

Passed (12:20)

Failure (2:30)

Passed (4:40)

I want to change the cell color based on only Passed and Failure and ignore rest of the string.

Re: Using wild card in table column formating

bowesmana — Sun, 04 Dec 2022 22:19:08 GMT

Use the colorPalette format option

<format type="color" field="your_field">
<colorPalette type="expression">case(match(value,"^Passed"), "#008000", match(value, "^Failed"), "#F8BE34", true(), "#000")</colorPalette>
</format>

See the documentation here

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML#Color_palette_types_and_options

Re: Using wild card in table column formating

splunkuser320 — Mon, 05 Dec 2022 04:27:53 GMT

Its works. Thanks for your help!!!

Re: Using wild card in table column formating

bowesmana — Mon, 05 Dec 2022 23:41:20 GMT

If this was a solution for you, please mark it as solved, so others can benefit.