Dashboards & Visualizations

How color a field by other value in XML

Bracha
Path Finder

 

 

Hey
I know that such a question has been asked many times but I still haven't found a relevant answer that works for me.

I have a table and I want to color a column with a different variable,

 

|stats values(interfaceName) as importer
|eval importer_in_csv=if(isnull(max_time),0,1)

 

I want to color the importer column if importer_in_csv = 0
How do I do it in XML?
thanks!!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This can't be done with this search because there is no field called max_time - please clarify your search

0 Karma

Bracha
Path Finder

this is my search:

|search index=****** interfaceName=*
|stats values(interfaceName) as importer
|join type=lest
     [|search index=****** Code=*
        [|inputlookup importers.csv
         |table interfaceName]
      |lookup importers.csv interfaceName OUTPUTNEW system timeRange
      |where like(system, "%") 
      |stats
         values(system) as reality
         values(timeRange) as max_time
|eval importer_in_csv=if(isnull(max_time),0,1)

I want to color the importer column if importer_in_csv = 0
How do I do it in XML?
thanks!!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You first mention colouring the column, then the row - if you want to colour the column then you can do it if your importer is a single value field - from your search you are doing stats values().. as importer, but the principle of colouring a column (not row) based on its relation to another field is to make the column you want to colour a multivalue field by appending the indicator, e.g.

| eval importer=mvappend(importer, importer_in_csv)

and to then limit the number of values shown for that field to 1 with some CSS, e.g.

<html depends="$hidden$">
  <style>
    #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
      display: none;
    }
  </style>
</html>

and then to use a format statement in the table definition

<format type="color" field="importer">
  <colorPalette type="expression">case(mvindex(value, 1) == "0", "#FF0000", mvindex(value, 1) == "1", "#00FF00")</colorPalette>
</format>

However, it's not clear from your search what your data actually looks like as the join subsearch is not terminated, so it's not clear where it ends and you don't appear to have any common fields to join with.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@bowesmana The problem with this method (which I hinted at) is that the field in question is already a multi-value field, and this method hides the second value (which with this method would be an indicator for the colour), but it looks like (from the search shared by OP) this may contain actual data values.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@ITWhisperer yes, agreed, but going on the search, it seems to be handwritten rather than copy/paste (type=lest) and it wasn't clear to me if the data really is MV or SV. I couldn't figure out what in fact the join was doing without any common fields - it's effectively an appendcols with no correlation between importer values.

That colouring technique is certainly only suitable for SV fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@bowesmana I have got it to work with MV but the colouring element has to be at the beginning and hidden, which means every field has to become a MV with some sort of colour indicator prepended. It is a little messy and until it is clear what is actually going on with the search, I didn't want to spend too much time on it. 😎

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given your search, you have a multi-value field - if you coloured this it would be the whole field, not just the importer that was missing. Is this what you really want?

0 Karma

Bracha
Path Finder

Yes
I want it to color the entire row if the importer_in_csv = 0

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...