Dashboards & Visualizations

Color a row based on a column value

sweety1309
Explorer

Hey I have the query-

index="classroom-students" profile.emailAddress="something" earliest=0 latest=now
| join type=outer courseId
[search index="courses" courseState="ACTIVE" ]
| join type=outer courseId max=0
[search index="course-work" | rename id as courseWorkId ]
| join type=outer userId, courseId, courseWorkId
[search index="students-submission" | dedup userId, courseId, courseWorkId sortby -updateTime]
| rename profile.name.fullName as StudentName
| rename name as Classroom
| rename submissionHistory{}.gradeHistory.pointsEarned
as pointsEarned
| table StudentName, courseId, courseWorkId, userId, Classroom, descriptionHeading, title, workType, maxPoints, pointsEarned, state, late.

In late column,i get "true" in some rows.I want to color those rows where I am getting "true" in late column.Like if u look at the imagfe,I want to color the whole second row.

Any help would be highlt appreciated.Thanks in advance.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

        <format type="color">
          <colorPalette type="expression">if(match(value,"true"),"#53A051",null)</colorPalette>
        </format>
0 Karma

sweety1309
Explorer

Thanks for ur response.I want that whole row to get coloured which contains true value.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry I missed a couple of steps

You need a hidden panel with some style

    <panel depends="$stayhidden$">
      <title>Only SimpleXML no JS required</title>
      <html>
        <style>
          #tableRowColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
    </panel>

  You need to name your table with a matching id - if it already has an id, adjust the above style

      <table id="tableRowColor">

Then you need to add this to the end of your query

| foreach * [| eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',late)]

This assumes you don't already have multi-value fields in your table. If you do, you could try changing the order of the mvappend to stick a copy of the late field at the front of mv field and change the index in the style to 0

0 Karma

sweety1309
Explorer

Thanks a lot for ur quick response @ITWhisperer .

If u look at the image,true value is coming in all the columns now which I dont want.Can u please help me with this.

Thanks in advance

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The style hides the second element of the multivalue fields - the reason you have them showing is that you either haven't included that part of the solution or the table id does not match the name used in the style.

0 Karma

sweety1309
Explorer

This is how I have written its query.Can u plz point out my mistake @ITWhisperer 

<row>
<panel depends="$stayhidden$">
<title>Only SimpleXML no JS required</title>
<html>
<style>
#tableRowColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
</panel>
<panel>
<table id="tableRowColor">
<search>
<query>index="dpsn-classroom-students" profile.emailAddress="$email$" earliest=0 latest=now
| join type=outer courseId
[search index="dpsn-courses" courseState="ACTIVE" ]
| join type=outer courseId max=0
[search index="dpsn-course-work" | rename id as courseWorkId ]
| join type=outer userId, courseId, courseWorkId
[search index="dpsn-students-submission" | dedup userId, courseId, courseWorkId sortby -updateTime]
| rename profile.name.fullName as StudentName
| rename name as Classroom
| rename submissionHistory{}.gradeHistory.pointsEarned
as pointsEarned
| foreach * [| eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',late)]
| table StudentName, courseId, courseWorkId, userId, Classroom, descriptionHeading, title, workType, maxPoints, pointsEarned, state
</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<option name="count">20</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color">
<colorPalette type="expression">if(match(value,"true"),"#53A051",null)</colorPalette>
</format>
</table>
</panel>
</row>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I can't see anything wrong with what you have posted except that it does not match the image, for example, late is not listed as a field in the table command. Having said that, this should not affect the solution as you have already copied it to the multi value fields. On that, I also noticed in the image that pointsEarned only has the value true in, so you might want to consider using fillnull to ensure all columns have a value before the foreach which is adding the true. Neither of these should prevent the solution from working. Can you check that the html tags in use match the values used in the style. You can do this by inspecting the page in the browser.

0 Karma

sweety1309
Explorer

I have attached the screenshot on the inspect element.Please have a look @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could also try giving the style a bit of priority - possibly needed if you have other styles applied?

<style>
#tableRowColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none !important;
}
</style>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you capture a bit further up to include the div id="tableRowColor" down to the td?

0 Karma

sweety1309
Explorer

Here is the screenshot @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you select the second multivalue element so we can see what style are being applied?Screenshot 2021-02-10 at 3.44.25 PM.png

0 Karma

sweety1309
Explorer

As you can see in the picture..Some td tags have two div containing true.If I remove the second true div,the work is done. @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I didn't see anything in your Simple XML that would add an additional element to the multi-value fields. Has the issue now been fixed?

0 Karma

sweety1309
Explorer

No,I m facing the same issue @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share a screenshot of the inspection with the second element (the one with data-mv-index="1") selected to show what styles are in operation, so we can track down why the element is still being shown?

0 Karma

sweety1309
Explorer

Ya sure.Here is the screenshot @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to select the td two lines downScreenshot 2021-02-11 at 2.03.34 PM.png

0 Karma

sweety1309
Explorer
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The style looks right on the first true. So, the issue is where does the second true come from (since this is the one being displayed)?

Can you provide the current simple xml you are using?

The other possibility is that we add another selector for the style to include index 2

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...