Color code for date column not working in Splunk dashboard

[Splunk_sid]

Hi Team,

I'm trying to color code Date column in Table visualization based on nested if condition. But, it isn't working. Kindly assist to fix this issue

Sample code:
</format>
<format type="color" field="Batch_Date">
<colorPalette type="expression">if(strptime(Batch_Date, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>
</format>

Regards,
Siddarth

[livehybrid · Accepted solution]

Hi @Splunk_sid 

You need to use 'value' instead of the field name:

        <colorPalette type="expression">if(strptime(value, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>

livehybrid_0-1756897849638.png

Full example:

<dashboard version="1.1" theme="light">
  <label>FieldBGColourEval</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults | eval Batch_Date="02-09-2025"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <format type="color" field="Batch_Date">
        <colorPalette type="expression">if(strptime(value, "%d-%m-%Y") &lt;= relative_time(now(), "-1d@d"), "#55C169", "#ffffff")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Splunk_sid]

Hello @livehybrid ,

Thank you very much. I got the required result now. However, I see one issue here. When I try to clone this to Dashboard Studio, this particular color formatting didn't get converted . Can you suggest a way to make it work ?

Regards,
Siddarth