Solved: Re: Condition based Font Color in XML Dashboard

dinesh001kumar · ‎01-14-2026

Hi All,

I am having XML Dashboard in the below format, I have applied colorPalette expression in Splunk natively applying for the cell, but request was the color should apply only font colour not on cell.

If values are greater than 99.90, then font should be in green colour -->

If values are greater than 99 and less than 99.90, font should be in amber -->

If values are less than 99, font should be in Red-->

Incase null i have used fillnull as "-" ,should be grey or black-->

Can anyone please help on this to achieve the requirement.

ITWhisperer · ‎01-14-2026

Try something like this

<dashboard version="1.1" theme="light">
  <label>Font colours</label>
  <row>
    <panel depends="$alwayshidden$">
      <html>
        <style>
          #fontcolours div.multivalue-subcell[data-mv-index="0"] {
              color: limegreen !important;
            }
          #fontcolours div.multivalue-subcell[data-mv-index="1"] {
              color: orange !important;
            }
          #fontcolours div.multivalue-subcell[data-mv-index="2"] {
              color: red !important;
            }
          #fontcolours div.multivalue-subcell[data-mv-index="3"] {
              color: grey !important;
            }
        </style>
      </html>
    </panel>
    <panel>
      <table id="fontcolours">
        <search>
          <query>| makeresults count=10
| fields - _time
| eval A=100-(random()%201/100)
| eval B=100-(random()%201/100)
| eval C=100-(random()%201/100)
| foreach A B C
    [| eval &lt;&lt;FIELD&gt;&gt;=case(&lt;&lt;FIELD&gt;&gt;&lt;=98.2,mvappend("","","","-"),&lt;&lt;FIELD&gt;&gt;&gt;=99.90,mvappend(&lt;&lt;FIELD&gt;&gt;,"","",""),&lt;&lt;FIELD&gt;&gt;&gt;=99,mvappend("",&lt;&lt;FIELD&gt;&gt;,"",""),true(),mvappend("","",&lt;&lt;FIELD&gt;&gt;,""))]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

Basically, you can colour font by selecting different multivalues

View solution in original post

dinesh001kumar · ‎01-14-2026

Thanks it works

ITWhisperer · ‎01-14-2026

Try something like this

<dashboard version="1.1" theme="light">
  <label>Font colours</label>
  <row>
    <panel depends="$alwayshidden$">
      <html>
        <style>
          #fontcolours div.multivalue-subcell[data-mv-index="0"] {
              color: limegreen !important;
            }
          #fontcolours div.multivalue-subcell[data-mv-index="1"] {
              color: orange !important;
            }
          #fontcolours div.multivalue-subcell[data-mv-index="2"] {
              color: red !important;
            }
          #fontcolours div.multivalue-subcell[data-mv-index="3"] {
              color: grey !important;
            }
        </style>
      </html>
    </panel>
    <panel>
      <table id="fontcolours">
        <search>
          <query>| makeresults count=10
| fields - _time
| eval A=100-(random()%201/100)
| eval B=100-(random()%201/100)
| eval C=100-(random()%201/100)
| foreach A B C
    [| eval &lt;&lt;FIELD&gt;&gt;=case(&lt;&lt;FIELD&gt;&gt;&lt;=98.2,mvappend("","","","-"),&lt;&lt;FIELD&gt;&gt;&gt;=99.90,mvappend(&lt;&lt;FIELD&gt;&gt;,"","",""),&lt;&lt;FIELD&gt;&gt;&gt;=99,mvappend("",&lt;&lt;FIELD&gt;&gt;,"",""),true(),mvappend("","",&lt;&lt;FIELD&gt;&gt;,""))]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

Basically, you can colour font by selecting different multivalues

Condition based Font Color in XML Dashboard

table

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation