Dashboards & Visualizations

Color Palette Expression based on two fields

strehb18
Path Finder

Is it possible in xml to create a color palette based on two separate fields. I would like a field to be a specific value to color another field while that field also being conditional. 

In my case, I have a field called task_pct and one called labor_variance. I would like to only do a color scheme if task_pct is 1.00 for 100% complete and then red for anything above 0 and green for anything below 0 while also ignoring coloring if it is not 1.00. 

Labels (4)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

You can set up two panels with identical labor_variance, then hide one or the other based on task_pct.  Like this:

Color

No color

negative-colored.pngpositive-colored.png

image.pngpositive-no-color.png

 

The following code borrows from How to set token from search and then conditionally show a panel.

<form version="1.1" theme="light">
  <label>Color palette based on two values</label>
  <description>https://community.splunk.com/t5/Dashboards-Visualizations/Color-Palette-Expression-based-on-two-fields/m-p/757387#M59355</description>
  <fieldset submitButton="false">
    <input type="radio" token="task_pct_tok" searchWhenChanged="true">
      <label>task_pct</label>
      <choice value="0">0</choice>
      <choice value="0.5">0.5</choice>
      <choice value="1">1.0</choice>
      <default>1</default>
    </input>
    <input type="radio" token="labor_variance_tok" searchWhenChanged="true">
      <label>labor_variance</label>
      <choice value="-0.2">-0.2</choice>
      <choice value="0">0</choice>
      <choice value="0.5">0.5</choice>
      <default>0.5</default>
    </input>
  </fieldset>
  <row>
    <panel depends="$useColors_tok$">
      <title>task_pct is $task_pct_tok$</title>
      <single>
        <search>
          <query>| makeresults format=csv data="labor_variance,task_pct
$labor_variance_tok$,$task_pct_tok$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <condition>
              <eval token="useColors_tok">if($result.task_pct$ == 1, "true", null())</eval>
            </condition>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.0</option>
        <option name="rangeColors">["0x53a051","0xdc4e41"]</option>
        <option name="rangeValues">[0]</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel rejects="$useColors_tok$">
      <title>task_pct_is $task_pct_tok$</title>
      <single>
        <search>
          <query>| makeresults format=csv data="labor_variance,task_pct
$labor_variance_tok$,$task_pct_tok$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0.0</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

The same idea can be used in Dashboard Studio.

In this example, the same search is performed in both panels.  If your search is expensive, you can set it up in a base search and reference the base search in panels.  In Simple XML, there is no clear documentation about how to do this; and it generally requires lots of diligence.  In Dashboard Studio, base search is managed as a feature.

Tags (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...