Dashboards & Visualizations

How to Color a cell based on the increment rate from the previous value

yifatcy
Path Finder

Hi,

Say I have the following table:

Name  2022-06-07 10:01:14 2022-06-07 22:01:13 2022-06-08 10:01:11 2022-06-08 22:01:25 2022-06-09 10:01:22 2022-06-09 22:00:59 2022-06-10 10:01:28
a 301 300 302 303 301 400 412
b 200 220 235 238 208 300 302

Can I color a cell based on the increment rate from the previous value? for instance- if the value increased by 10%, it will be yellow, 20% would be Orange and so on. 
I'm looking for a solution based on simple xml where no additional files are needed.

Thanks.

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

yifatcy
Path Finder

Perfect! it worked,

One more thing, how do I remove the color name from the final output?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That's part of the solution - you have some embedded CSS (no additional files), which set the display type to none for the second (index 1) multi-part cell.

Possibly clearer to see here https://community.splunk.com/t5/Splunk-Search/How-to-change-table-cell-background-color-depends-on-s... 

yifatcy
Path Finder

Great!, had a syntax problem but now worked. Thanks again

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...