I created a table that outputs the organization, threshold, count, and response time. If the response time is greater than the threshold, then I want the response time value to turn red. However, the threshold is different for every organization. Is there a way to dynamically set the threshold on the table for the Response Time column to turn red based on its respective threshold.
For example, organization A will have a threshold of 3, while organization B will have a threshold of 10. I want the table to display all the organizations,count, the response time, and the threshold.
index | stats count as "volume" avg as "avg_value" by organization, _time, threshold
Kindly help.
You can do it, but it's a little fiddly - it involves making the response value a multivalue field with the response value as the first element and an indicator whether it's over threshold saved as the second value.
Using CSS you stop the second value from being displayed, then use the standard colorPalette settings to set the colour.
Here's an example panel that demonstrates how
<panel>
<html depends="$hidden$">
<style>
#coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="coloured_cell">
<title>Colouring a table cell based on it's relative comparison to another cell</title>
<search>
<query>
| makeresults count=10
| fields - _time
| eval Threshold=random() % 100, Value=random() % 100
| eval Comparison=case(Value < Threshold,-1, Value > Threshold, 1, true(), 0)
| eval Value=mvappend(Value, Comparison)
| table Threshold Value
</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<format type="color" field="Value">
<colorPalette type="expression">case(mvindex(value, 1) == "1", "#ff0000", mvindex(value, 1) == "-1", "#000000", true(), "#00ff00")</colorPalette>
</format>
</table>
</panel>
It will make a field called Comparison which is -1 if the Value is < Threshold, =1 if Value is > Threshold otherwise 0. This is appended to the real value field
Then the <colorPalette> statement will test the mvindex(..1) which gives the Comparison number and the expression defines the colour.