Not sure if this is a potential bug or simply not doable but trying to colour format a field whilst comparing it to the expected value of another field.
ie if field 1!= field 2 then colour field 1 as red
Below was the sample in the source used:
<format type="color" field="netbox_tenant"> <colorPalette type="expression"> if (netbox_tenant!=tenant,"#53A051","#DC4E41")</colorPalette>
Result looked like below:
Those top three should be green based on logic although it appears to colour everything with the first choice colour - have tried multiple different statements (case etc) but doesn't seem to want to work.
By itself, you can't do that exactly as you are trying to. It appears that you already figured out the new column with pass/fail. That's how to go about something similar.
@efavreau thanks for coming back!
Is this something that would be doable in the near future? Or could potentially have a feature request for?
The Pass/Fail at the end is an eval where I'm comparing 4-5 different fields that we might care about.
Was looking to colour the fields in the way I've described so that for each fail you see exactly which field/s causes the overall fail.
I have other pages similar to this where I'll be doing pass/fail logic comparing 10+ fields - alternative would be to create a column per item checked as well as this overall Pass/Fail column although you wouldn't see nicely which field is the failing item..
@fflimaI don't know if such a feature would be coming. Likely Splunk won't comment on that. Ideas can be posted to https://ideas.splunk.com/ (there's a link at the top of the page here within the Splunk Community site). You are correct, having a new column that does the comparison for each would be a way to solve it. If there's another way, maybe someone else in the community knows.
However, when I've used a similar approach, I had another column called "Reason". I can't grab the logic right now (I used a couple case statements IIRC), so hopefully you can follow what I am trying to say.
If "pass" value, reason = ""
If "fail" value, reason = "Failed on ".fieldname