Dashboards & Visualizations

Color dynamic fields based on values in a table

nabeel652
Builder

I am running a search like this:

| makeresults | fields - _time | eval data = "Susan|Developer|Software,Chris|Admin|Server,Bob|Developer|Software,Tina|Admin|Server,Chris|Developer|Software" | table data | makemv delim="," data | mvexpand data | rex field=data "^(?<Employee>[^\|]*)\|(?<Role>[^\|]*)\|(?<Department>.*$)" | fields - data | xyseries Department, Employee, Role 

What I need is to be able to color cells in the final table based on user roles - like green for Developer, blue for Admin etc.

The problem is the field names are dynamic and I cannot find a way to set coloring options for such fields. I know it's tricky any thoughts? I'd prefer a non-HTML, non-Javascript solution as I am hosted in SplunkCloud.

I've tried field="*" in the format tag but it doesn't work.

<format type="color" field="*">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
</format>
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try with following. If you do not specify a field, the format rule is applied to the entire table.

  <format type="color">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
        </format>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try with following. If you do not specify a field, the format rule is applied to the entire table.

  <format type="color">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
        </format>
0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...