Color a row based on a column value

sweety1309 · ‎02-09-2021

Hey I have the query-

index="classroom-students" profile.emailAddress="something" earliest=0 latest=now
| join type=outer courseId
[search index="courses" courseState="ACTIVE" ]
| join type=outer courseId max=0
[search index="course-work" | rename id as courseWorkId ]
| join type=outer userId, courseId, courseWorkId
[search index="students-submission" | dedup userId, courseId, courseWorkId sortby -updateTime]
| rename profile.name.fullName as StudentName
| rename name as Classroom
| rename submissionHistory{}.gradeHistory.pointsEarned
as pointsEarned
| table StudentName, courseId, courseWorkId, userId, Classroom, descriptionHeading, title, workType, maxPoints, pointsEarned, state, late.

In late column,i get "true" in some rows.I want to color those rows where I am getting "true" in late column.Like if u look at the imagfe,I want to color the whole second row.

Any help would be highlt appreciated.Thanks in advance.

ITWhisperer · ‎02-09-2021

Try something like this

        <format type="color">
          <colorPalette type="expression">if(match(value,"true"),"#53A051",null)</colorPalette>
        </format>

sweety1309 · ‎02-09-2021

Thanks for ur response.I want that whole row to get coloured which contains true value.

ITWhisperer · ‎02-09-2021

Sorry I missed a couple of steps

You need a hidden panel with some style

    <panel depends="$stayhidden$">
      <title>Only SimpleXML no JS required</title>
      <html>
        <style>
          #tableRowColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
    </panel>

You need to name your table with a matching id - if it already has an id, adjust the above style

      <table id="tableRowColor">

Then you need to add this to the end of your query

| foreach * [| eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',late)]

This assumes you don't already have multi-value fields in your table. If you do, you could try changing the order of the mvappend to stick a copy of the late field at the front of mv field and change the index in the style to 0

sweety1309 · ‎02-09-2021

Thanks a lot for ur quick response @ITWhisperer .

If u look at the image,true value is coming in all the columns now which I dont want.Can u please help me with this.

Thanks in advance

ITWhisperer · ‎02-09-2021

The style hides the second element of the multivalue fields - the reason you have them showing is that you either haven't included that part of the solution or the table id does not match the name used in the style.

sweety1309 · ‎02-09-2021

This is how I have written its query.Can u plz point out my mistake @ITWhisperer

<row>
<panel depends="$stayhidden$">
<title>Only SimpleXML no JS required</title>
<html>
<style>
#tableRowColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
</panel>
<panel>
<table id="tableRowColor">
<search>
<query>index="dpsn-classroom-students" profile.emailAddress="$email$" earliest=0 latest=now
| join type=outer courseId
[search index="dpsn-courses" courseState="ACTIVE" ]
| join type=outer courseId max=0
[search index="dpsn-course-work" | rename id as courseWorkId ]
| join type=outer userId, courseId, courseWorkId
[search index="dpsn-students-submission" | dedup userId, courseId, courseWorkId sortby -updateTime]
| rename profile.name.fullName as StudentName
| rename name as Classroom
| rename submissionHistory{}.gradeHistory.pointsEarned
as pointsEarned
| foreach * [| eval <<FIELD>>=mvappend('<<FIELD>>',late)]
| table StudentName, courseId, courseWorkId, userId, Classroom, descriptionHeading, title, workType, maxPoints, pointsEarned, state
</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<option name="count">20</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color">
<colorPalette type="expression">if(match(value,"true"),"#53A051",null)</colorPalette>
</format>
</table>
</panel>
</row>

ITWhisperer · ‎02-10-2021

I can't see anything wrong with what you have posted except that it does not match the image, for example, late is not listed as a field in the table command. Having said that, this should not affect the solution as you have already copied it to the multi value fields. On that, I also noticed in the image that pointsEarned only has the value true in, so you might want to consider using fillnull to ensure all columns have a value before the foreach which is adding the true. Neither of these should prevent the solution from working. Can you check that the html tags in use match the values used in the style. You can do this by inspecting the page in the browser.

sweety1309 · ‎02-10-2021

I have attached the screenshot on the inspect element.Please have a look @ITWhisperer

ITWhisperer · ‎02-10-2021

You could also try giving the style a bit of priority - possibly needed if you have other styles applied?

<style>
#tableRowColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none !important;
}
</style>

ITWhisperer · ‎02-10-2021

Can you capture a bit further up to include the div id="tableRowColor" down to the td?

sweety1309 · ‎02-10-2021

Here is the screenshot @ITWhisperer

ITWhisperer · ‎02-10-2021

Can you select the second multivalue element so we can see what style are being applied? Screenshot 2021-02-10 at 3.44.25 PM.png

sweety1309 · ‎02-10-2021

As you can see in the picture..Some td tags have two div containing true.If I remove the second true div,the work is done. @ITWhisperer

ITWhisperer · ‎02-10-2021

I didn't see anything in your Simple XML that would add an additional element to the multi-value fields. Has the issue now been fixed?

sweety1309 · ‎02-10-2021

No,I m facing the same issue @ITWhisperer

ITWhisperer · ‎02-10-2021

Can you share a screenshot of the inspection with the second element (the one with data-mv-index="1") selected to show what styles are in operation, so we can track down why the element is still being shown?

sweety1309 · ‎02-11-2021

Ya sure.Here is the screenshot @ITWhisperer

ITWhisperer · ‎02-11-2021

You need to select the td two lines down Screenshot 2021-02-11 at 2.03.34 PM.png

sweety1309 · ‎02-11-2021

@ITWhisperer

ITWhisperer · ‎02-11-2021

The style looks right on the first true. So, the issue is where does the second true come from (since this is the one being displayed)?

Can you provide the current simple xml you are using?

The other possibility is that we add another selector for the style to include index 2

Color a row based on a column value

simple XML

Dashboards: Hiding charts while search is being executed and other uses for tokens

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

Are you a member of the Splunk Community?

Color a row based on a column value

simple XML

Dashboards: Hiding charts while search is being executed and other uses for tokens

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

Brains, Bytes, and Boston: Learn from the Best at .conf25