topic Re: coloring a row based on field value(with a wildcard/space) in Splunk Search

coloring a row based on field value(with a wildcard/space)

smolcj — Thu, 17 Jan 2013 06:46:39 GMT

hi,
for changing the color of a field we can change the css to
.Table tr.informational td {
background-color:#72c72d;
color:#fff;
}
what if the field name is having some space or if we have to add a wild card in the field value like
.Table tr.informational 1 td {
background-color:#72c72d;
color:#fff;
}

why i need wildcard because it can be informational 2 informational 3... etc.. something like info*.. is it possible?
Please help
Thank you

Re: coloring a row based on field value(with a wildcard/space)

sideview — Mon, 28 Sep 2020 13:07:39 GMT

In this question you're asking about the "rowClass" param of the Sideview Table module, and for those following along this question came from a comment on this other question - http://splunk-base.splunk.com/answers/60993/colorize-simpleresultstable-rows-based-on-field-values.

The value of the Table module's rowClass param, as calculated at runtime can contain spaces, whether or not those spaces come from the dynamic field value(s) present by virtue of $fieldName$, or from hardcoded parts of the string. However in CSS a space in there means that multiple classes are being applied indepently to the element. EG: if the rowClass value were "informational 1", then you'd be applying two classes independently, "informational", and "1". Each of those classes you'd have to define in your stylesheet, and needless to say "1" is a very strange classname to use.

To simplify this, I would stay away from spaces in the fieldnames that you're using in rowClass. Specifically I would use | eval myClassField=replace(myClassField," ","_") either in the base search or in a postProcess search, to turn those values into "informational_1", "informational_2", etc.. That will mean they act as a single class and you can define those informational_1, informational_2, informational_3 in your CSS.

Re: coloring a row based on field value(with a wildcard/space)

smolcj — Thu, 17 Jan 2013 10:43:07 GMT

so a wildcard idea is not possible here?

Re: coloring a row based on field value(with a wildcard/space)

sideview — Thu, 17 Jan 2013 18:10:50 GMT

No it is not. No such mechanism exists in CSS and in fact the "" character has its own meaning in CSS that would confuse things even further. Granted, if you let the "informational 1" values come down as rowClass values, you'd *get your wildcard behavior in the form of the "informational" class. You could leave the "1", "2" classes undefined and your "informational" class might work as the wild card you're wanting?