Dashboards & Visualizations

Color dynamic fields based on values in a table

nabeel652
Builder

I am running a search like this:

| makeresults | fields - _time | eval data = "Susan|Developer|Software,Chris|Admin|Server,Bob|Developer|Software,Tina|Admin|Server,Chris|Developer|Software" | table data | makemv delim="," data | mvexpand data | rex field=data "^(?<Employee>[^\|]*)\|(?<Role>[^\|]*)\|(?<Department>.*$)" | fields - data | xyseries Department, Employee, Role 

What I need is to be able to color cells in the final table based on user roles - like green for Developer, blue for Admin etc.

The problem is the field names are dynamic and I cannot find a way to set coloring options for such fields. I know it's tricky any thoughts? I'd prefer a non-HTML, non-Javascript solution as I am hosted in SplunkCloud.

I've tried field="*" in the format tag but it doesn't work.

<format type="color" field="*">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
</format>
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with following. If you do not specify a field, the format rule is applied to the entire table.

  <format type="color">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
        </format>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try with following. If you do not specify a field, the format rule is applied to the entire table.

  <format type="color">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
        </format>

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.