All Apps and Add-ons

How color code the dynamic Table

harshal_chakran
Builder

Hi I have the following code with a dynamic search command.

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True">
  <param name="search"><![CDATA[

|inputcsv RESULT.csv |search KPI|stats first(RESULT) as RESULT by KPI TIMESTAMP|eval myClassField=case(RESULT>10,"red", RESULT>0.6,"orange",RESULT<0.6,"green")|xyseries KPI TIMESTAMP RESULT myClassField

  ]]></param>

  <module name="Pager"><param name="count">100</param>

  <module name="Table">
    <param name="columns.RESULT.class">$row.fields.myClassField$</param>

<!-- $row.fields.myClassField2$
$row.fields.myClassField3$
$row.fields.myClassField4$ -->

    <param name="hiddenFields">myClassField</param>
  </module>
</module>

<module name="HTML" layoutPanel="panel_row4_col1">
  <param name="html"><![CDATA[

  <style type="text/css">

  .Table td.red {
    background-color:#f01b31;
    color:white;
  }

  .Table td.orange {
    background-color:#fcb316;
  }

  .Table td.yellow {
    background-color:#fef200;
  }

  .Table td.green {
    background-color:#82FA58;
  }

  </style>

  ]]></param>
</module>`

The output is as shown below:
alt text

The columns will go on increasing as the data grows. I want to color the cells based on "myClassfield" value. I was able to do it when my column names were static, but now as the column names are also dynamic and goes on increasing as RESULT:0000-0015, RESULT:0015-0030,RESULT:0030-0045, and so on...

Please Help...!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid this can't be done with the Table module today. At least not in this exact way.

If this were something I was working on, I would try to unwind one dimension out of it, so there was a little less going on. For instance you could have a high level chart display with a "traffic light" flavor to it, with some drilldown, and then also allow the user to pick one particular KPI at a time to see the timestamps and colors.

I might also use the Multiplexer, which is a crazy trick you can apply to kind of "get an extra dimension" back. In this example I use the Multiplexer module so that for each of your KPI values, there is a little header and a pageable table. And since here I've kinda taken a dimension out of each individual Table, suddenly the plain old "rowClass" param can color our fields.

<module name="Search" layoutPanel="panel_row4_col1" autoRun="True">
  <param name="search"><![CDATA[

| inputcsv RESULT.csv 
| search KPI 
| stats first(RESULT) as RESULT by KPI TIMESTAMP
| eval myClassField=case(RESULT>10,"red", RESULT>0.6,"orange",RESULT<0.6,"green")

  ]]></param>

  <module name="PostProcess">
    <param name="search">| stats count by KPI</param>

    <module name="Multiplexer">
      <param name="fields">KPI</param>

      <module name="PostProcess">
        <param name="search">| search KPI="$KPI$"</param>

        <module name="HTML">
          <param name="html"><![CDATA[
            <h3>$KPI$</h3>
          </param>
        </module>

        <module name="Pager">
          <module name="Table">
            <param name="hiddenFields">myClassField</param>
            <param name="rowClass">$row.fields.myClassField$</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...