Dashboards & Visualizations

How to Color a cell based on the increment rate from the previous value

yifatcy
Path Finder

Hi,

Say I have the following table:

Name  2022-06-07 10:01:14 2022-06-07 22:01:13 2022-06-08 10:01:11 2022-06-08 22:01:25 2022-06-09 10:01:22 2022-06-09 22:00:59 2022-06-10 10:01:28
a 301 300 302 303 301 400 412
b 200 220 235 238 208 300 302

Can I color a cell based on the increment rate from the previous value? for instance- if the value increased by 10%, it will be yellow, 20% would be Orange and so on. 
I'm looking for a solution based on simple xml where no additional files are needed.

Thanks.

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

yifatcy
Path Finder

Perfect! it worked,

One more thing, how do I remove the color name from the final output?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That's part of the solution - you have some embedded CSS (no additional files), which set the display type to none for the second (index 1) multi-part cell.

Possibly clearer to see here https://community.splunk.com/t5/Splunk-Search/How-to-change-table-cell-background-color-depends-on-s... 

yifatcy
Path Finder

Great!, had a syntax problem but now worked. Thanks again

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...