topic Re: How to highlight the lowest value in a statistics table with yellow or red? in Splunk Search

How to highlight the lowest value in a statistics table with yellow or red?

dbcase — Tue, 02 Aug 2016 20:58:02 GMT

Hi,

I have the search below and it works great. It outputs a table with the customer name, then a trendline, and then a percentage.

earliest=-24h index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=broadband |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |chart sparkline(avg(stat_val)) as Trend last(stat_val) as "Broadband Connectivity %" by mso|rename mso as Customer

What I'd like to do is highlight the LOWEST percentage value. I know this can be done with that stats table formatting, but Splunk uses RED for the HIGHEST value and BLUE for the LOWEST value (seems like they chose temperature colors). I'd like to highlight/identify the lowest value either with a yellow highlight (similar to the events) or RED text color.

Re: How to highlight the lowest value in a statistics table with yellow or red?

somesoni2 — Tue, 02 Aug 2016 21:05:51 GMT

Have a look at the "Table Cell Highlighting" example on the "Splunk 6.x: Dashboard Example" app.

App available here: https://splunkbase.splunk.com/app/1603/

It requires custom java scripts (script includes the field name) and css to be written.

Re: How to highlight the lowest value in a statistics table with yellow or red?

MuS — Tue, 02 Aug 2016 21:08:23 GMT

Hi dbcase,

install the dashboard example app https://splunkbase.splunk.com/app/1603/ and have a look at the Table Element with Data Overlay examples found here:

 http://yoursplunkserver:8000/en-US/app/simple_xml_examples/simple_table_data_overlay?earliest=0&latest=

Hope this helps ...

cheers, MuS

Re: How to highlight the lowest value in a statistics table with yellow or red?

dbcase — Tue, 02 Aug 2016 21:35:35 GMT

This is the one that is part of the table formatting. It is in the right ballpark but not quite. For the high value it uses the color RED which in this case is misleading. I'd like the LOW value to be RED so it will draw attention