Dashboards & Visualizations

How to Color a cell based on the increment rate from the previous value

yifatcy
Path Finder

Hi,

Say I have the following table:

Name  2022-06-07 10:01:14 2022-06-07 22:01:13 2022-06-08 10:01:11 2022-06-08 22:01:25 2022-06-09 10:01:22 2022-06-09 22:00:59 2022-06-10 10:01:28
a 301 300 302 303 301 400 412
b 200 220 235 238 208 300 302

Can I color a cell based on the increment rate from the previous value? for instance- if the value increased by 10%, it will be yellow, 20% would be Orange and so on. 
I'm looking for a solution based on simple xml where no additional files are needed.

Thanks.

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can try something like this

| foreach *-*
    [| eval <<FIELD>>=if(isnull(_previous),'<<FIELD>>',mvappend('<<FIELD>>',if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.1,"GREEN",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.2,"YELLOW",if(tonumber(mvindex('<<FIELD>>',0))/tonumber(_previous)<1.3,"ORANGE","RED")))))
    | eval _previous=mvindex('<<FIELD>>',0)]

and then follow the recommendations in other solutions such as this https://community.splunk.com/t5/Dashboards-Visualizations/How-to-update-table-cell-color-as-per-the-... 

yifatcy
Path Finder

Perfect! it worked,

One more thing, how do I remove the color name from the final output?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That's part of the solution - you have some embedded CSS (no additional files), which set the display type to none for the second (index 1) multi-part cell.

Possibly clearer to see here https://community.splunk.com/t5/Splunk-Search/How-to-change-table-cell-background-color-depends-on-s... 

yifatcy
Path Finder

Great!, had a syntax problem but now worked. Thanks again

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...