Color dynamic fields based on values in a table

[nabeel652]

I am running a search like this:

| makeresults | fields - _time | eval data = "Susan|Developer|Software,Chris|Admin|Server,Bob|Developer|Software,Tina|Admin|Server,Chris|Developer|Software" | table data | makemv delim="," data | mvexpand data | rex field=data "^(?<Employee>[^\|]*)\|(?<Role>[^\|]*)\|(?<Department>.*$)" | fields - data | xyseries Department, Employee, Role 

What I need is to be able to color cells in the final table based on user roles - like green for Developer, blue for Admin etc.

The problem is the field names are dynamic and I cannot find a way to set coloring options for such fields. I know it's tricky any thoughts? I'd prefer a non-HTML, non-Javascript solution as I am hosted in SplunkCloud.

I've tried field="*" in the format tag but it doesn't work.

<format type="color" field="*">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
</format>

[vnravikumar · Accepted solution]

Hi

Try with following. If you do not specify a field, the format rule is applied to the entire table.

  <format type="color">
          <colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
        </format>