Dashboards & Visualizations

Color a row based on a column value

sweety1309
Explorer

Hey I have the query-

index="classroom-students" profile.emailAddress="something" earliest=0 latest=now
| join type=outer courseId
[search index="courses" courseState="ACTIVE" ]
| join type=outer courseId max=0
[search index="course-work" | rename id as courseWorkId ]
| join type=outer userId, courseId, courseWorkId
[search index="students-submission" | dedup userId, courseId, courseWorkId sortby -updateTime]
| rename profile.name.fullName as StudentName
| rename name as Classroom
| rename submissionHistory{}.gradeHistory.pointsEarned
as pointsEarned
| table StudentName, courseId, courseWorkId, userId, Classroom, descriptionHeading, title, workType, maxPoints, pointsEarned, state, late.

In late column,i get "true" in some rows.I want to color those rows where I am getting "true" in late column.Like if u look at the imagfe,I want to color the whole second row.

Any help would be highlt appreciated.Thanks in advance.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It has just occurred to me where the additional true is coming from. The fields which come alphabetically after late are the ones with the extra true. This means that the mvappend is taking the updated value of late i.e. two copies of true, for these subsequent fields. Try changing to this

 

| foreach * [| eval <<FIELD>>=mvappend('<<FIELD>>',mvindex(late,0))]

 

or

| foreach * [| eval <<FIELD>>=if("<<FIELD>>"=="late",late,mvappend('<<FIELD>>',late))]
0 Karma

sweety1309
Explorer

This solves my problem to a few extent as it removes true from the already filled column but doesnt remove it from the empty one.Please have a look at the image.

 

Thanks for ur reply @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try putting the copy of late as the first entry in the mv fields then hiding index 0

| foreach * [| eval <<FIELD>>=if("<<FIELD>>"=="late",late,mvappend(late,'<<FIELD>>'))]
| eval late=mvappend(late,late)

 

<style>
#tableRowColor table tbody td div.multivalue-subcell[data-mv-index="0"]{
display: none !important;
}
</style>
0 Karma

sweety1309
Explorer

Still facing this issue @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share a screen capture of an inspection of the problematic fields?

0 Karma

sweety1309
Explorer

Sure.Here is the screenshot @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK so the issue is that the fields only have one entry in so are not displayed as multivalue-subcells. To fix this, you could either add true twice and hide two rows, or use fillnull value="" before the foreach so at least there is an empty string (with this you can go back to adding the true after each field or leave it as adding it before)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...