Dashboards & Visualizations

How to change cell color based on condition in a dashboard?

priya1926
Path Finder

Here is my query:

<table id="tableColorFinalRowBasedOnData7">
<search>
<query>index="xxxx" source=service (DisplayName="a*" OR DisplayName="b*") host IN (abc xyz) earliest=-60m
| dedup host Name
| table host Name StartMode State | sort Name
| eval color=case(State="Stopped","#880808",State="Running","#008000")
| foreach host Name StartMode State[eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<format type="color">
<colorPalette type="map">{"Manual":#FF7F50}</colorPalette>
</format>
<format type="color" field="host">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="StartMode">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>

Service running is getting displayed as green and stopped as red but startmode manual is not setting to orange.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval color=case(State="Stopped","#880808",State="Running","#008000",State="Manual","#FF7F50")
0 Karma

priya1926
Path Finder

@ITWhisperer I already tried this and it doesnot work because i have StartMode as Manual and State as Stopped.. So the entire cell is displayed as RED. But i need Manual to be in Orange.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval color=case(State="Stopped","#880808",State="Running","#008000")
| foreach host Name State[eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| eval StartMode=if(StartMode="Manual",mvappend(StartMode,"#FF7F50"),StartMode)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...