- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi. Wondering if someone has found a similar solution?
I don't have admin rights so I don't have the ability to load js/css files to the splunk server so it all has to be within local XML code.
Here's a simple breakdown of what I'd like my table on the dashboard to do:
query | table A, B, C, D, E
When column A has the string value of "problem" I want to highlight the background of column B to red otherwise Column A remains default background color. And I need to hide column A from the end user.
I found many posts (including the 2 below) but after a couple of days, no luck in finding the correct logic..
Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

This can be done with CSS which you can define in your SimpleXML in a html panel. Essentially, what you need to do is to turn column B into a multi-value field with an indicator for the format option to pick up and change the background colour. You then use CSS to hide (display: none) the second value in the multi-value field. You can also hide column A in this way too. See this answer (and similar) for clues https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

This can be done with CSS which you can define in your SimpleXML in a html panel. Essentially, what you need to do is to turn column B into a multi-value field with an indicator for the format option to pick up and change the background colour. You then use CSS to hide (display: none) the second value in the multi-value field. You can also hide column A in this way too. See this answer (and similar) for clues https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked!
I have seen the mv referenced on other posts trying to do this same thing but it never made sense. But after reading your post here + reading more about mvs in splunk, it made a bit more sense. Plus several tries!
I've used Tableau for years, so trying to setup this conditional formatting is much easier to do than Splunk. I like Splunk but there is definitely a learning curve.
Thank you again!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @AdrianH,
sorry but it's not possible without js/css!
The only thing that you can do in Simple XML is use colors related to values.
In other words, when you create a table and open it in Edit Mode, you have a pen icon on each colum, you can choos the colors to use when there a value.
In this way you can highlight with colors a cell, not a column or a row.
for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.1/Viz/TableFormatsFormatting
Ciao.
Giuseppe
