Dashboards & Visualizations

Color code for date column not working in Splunk dashboard

Splunk_sid
Explorer

Hi Team,

I'm trying to color code Date column in Table visualization based on nested if condition. But, it isn't working. Kindly assist to fix this issue

Sample code:
</format>
<format type="color" field="Batch_Date">
<colorPalette type="expression">if(strptime(Batch_Date, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>
</format>

Regards,
Siddarth

Labels (2)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @Splunk_sid 

You need to use 'value' instead of the field name:

        <colorPalette type="expression">if(strptime(value, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>

livehybrid_0-1756897849638.png

 

Full example:

<dashboard version="1.1" theme="light">
  <label>FieldBGColourEval</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults | eval Batch_Date="02-09-2025"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <format type="color" field="Batch_Date">
        <colorPalette type="expression">if(strptime(value, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @Splunk_sid 

You need to use 'value' instead of the field name:

        <colorPalette type="expression">if(strptime(value, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>

livehybrid_0-1756897849638.png

 

Full example:

<dashboard version="1.1" theme="light">
  <label>FieldBGColourEval</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults | eval Batch_Date="02-09-2025"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <format type="color" field="Batch_Date">
        <colorPalette type="expression">if(strptime(value, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Splunk_sid
Explorer

Hello @livehybrid ,

Thank you very much. I got the required result now. However, I see one issue here. When I try to clone this to Dashboard Studio, this particular color formatting didn't get converted . Can you suggest a way to make it work ?


Regards,
Siddarth

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...