Dashboards & Visualizations

How do you change the cell color based on partial value?

twh1
Communicator

I have a few fields which contain string values. I want to change the color of a cell if particular work is present in the string.

Sample Field value
--------------------------------------
CRS-4638: Oracle High Availability Services is online
CRS-4537: Cluster Ready Services is online
CRS-4529: Cluster Synchronization Services is online
CRS-4533: Event Manager is online

If string contains the keyword "online" , I want to change the cell color. If it contains "offline" , I want to change the cell to another color.

0 Karma
1 Solution

mayurr98
Super Champion

hey @twh1

Try this

<format type="color" field="field_value">
          <colorPalette type="expression">if (like(value,"%online%"),"#FF5733","#247bc1")</colorPalette>
        </format>

OR
to be very specific try:

<format type="color" field="field_value">
          <colorPalette type="expression">case (like(value,"%online%"),"#FF5733",like(value,"%offline%"),"#247bc1")</colorPalette>
        </format>

sample run anywhere XML

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval field_value="CRS-4638: Oracle High Availability Services is online,CRS-4537: Cluster Ready Services is online,CRS-4529: Cluster Synchronization Services is online,CRS-4533: Event Manager is online,CRS-4533: Event Manager is offline"| makemv field_value delim="," | mvexpand field_value</query>
          <earliest>1536587628.000</earliest>
          <latest>1536587628.001</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="field_value">
          <colorPalette type="expression">if (like(value,"%online%"),"#FF5733","#247bc1")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @twh1

Try this

<format type="color" field="field_value">
          <colorPalette type="expression">if (like(value,"%online%"),"#FF5733","#247bc1")</colorPalette>
        </format>

OR
to be very specific try:

<format type="color" field="field_value">
          <colorPalette type="expression">case (like(value,"%online%"),"#FF5733",like(value,"%offline%"),"#247bc1")</colorPalette>
        </format>

sample run anywhere XML

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval field_value="CRS-4638: Oracle High Availability Services is online,CRS-4537: Cluster Ready Services is online,CRS-4529: Cluster Synchronization Services is online,CRS-4533: Event Manager is online,CRS-4533: Event Manager is offline"| makemv field_value delim="," | mvexpand field_value</query>
          <earliest>1536587628.000</earliest>
          <latest>1536587628.001</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="field_value">
          <colorPalette type="expression">if (like(value,"%online%"),"#FF5733","#247bc1")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

let me know if this helps!

vrmandadi
Builder

@mayurr98 ...How do we change the field="field_value" if there like 50 values ..can we use  like wild character like field="host*" ?

<format type="color" field="field_value">
          <colorPalette type="expression">if (like(value,"%online%"),"#FF5733","#247bc1")</colorPalette>
        </format>

  

0 Karma

abulco01
Explorer

This little trick worked for me. Thank you very much @mayurr98!

0 Karma

twh1
Communicator

Hi @mayurr98
I tried the above option but not getting desired output.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...