How to Color a cell based on the increment rate from the previous value

[yifatcy]

Hi,

Say I have the following table:

Name	2022-06-07 10:01:14	2022-06-07 22:01:13	2022-06-08 10:01:11	2022-06-08 22:01:25	2022-06-09 10:01:22	2022-06-09 22:00:59	2022-06-10 10:01:28
a	301	300	302	303	301	400	412
b	200	220	235	238	208	300	302

Can I color a cell based on the increment rate from the previous value? for instance- if the value increased by 10%, it will be yellow, 20% would be Orange and so on. 
I'm looking for a solution based on simple xml where no additional files are needed.

Thanks.

[ITWhisperer · Accepted solution]

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

[yifatcy]

Perfect! it worked,

One more thing, how do I remove the color name from the final output?

[ITWhisperer]

That's part of the solution - you have some embedded CSS (no additional files), which set the display type to none for the second (index 1) multi-part cell.

Possibly clearer to see here https://community.splunk.com/t5/Splunk-Search/How-to-change-table-cell-background-color-depends-on-s... 

[yifatcy]

Great!, had a syntax problem but now worked. Thanks again