How to color a cell on dashboard based on condition when column names are dynamic?

[bhavlik]

I have a table within a dashboard that is displaying information comparing event counts from a customer site to the event counts back here at corporate.  The goal is to easily identify if corporate is missing any event data from the customer site.  Here is a screenshot of the table:

I want to highlight any cells where "Missing=Yes" so it visually pops out to anyone viewing the dashboard.  I found this post How-do-you-change-the-cell-color-based-on-partial-value but that solution is for columns whose name remain the same.  In my table, the column names will change each day as the column names are the dates being displayed.  

Is there a way to color a cell based on a condition when the column names are dynamic?  

I also want to offer up that I am a beginner in Splunk and have no experience with using JavaScript or anything else besides Simple XML.

Thanks in advance for any suggestions.

[ITWhisperer · Accepted solution]

If you don't specify a field name, it applies to the whole table, so try:

        <format type="color">
          <colorPalette type="expression">if(match(value,"Missing=Yes"),"#53A051",null)</colorPalette>
        </format>

[a1bg503461]

Veryy helpful! Thx!

My case is with three conditions , can you help me color different cases as such please?

LogLevel : INFO -> Blue

LogLevel : WARRNING -> Yellow

LogLevel : Error -> Red

What I come up with is below but not working   😞 

<format type="color">
<colorPalette type="expression">

if(match(value,"logLevel=INFO"),"#4f34eb",null),

if(match(value,"logLevel=WARNING"),"#ffff00",null),

if(match(value,"logLevel=ERROR"),"#53A051",null)

</colorPalette>
</format>

[ITWhisperer]

Try something like this

<format type="color">
<colorPalette type="expression">

case(match(value,"logLevel=INFO"),"#4f34eb",match(value,"logLevel=WARNING"),"#ffff00",match(value,"logLevel=ERROR"),"#53A051")

</colorPalette>
</format>

[a1bg503461]

Sadly its still not working all is colored red as the last defined one:

       <format type="color">
<colorPalette type="expression">

case(match(value,"logLevel=INFO"),"#4f34eb",match(value,"logLevel=WARNING"),"#ffff00",match(value,"logLevel=ERROR"),"#53A051")

</colorPalette>
</format>

[bhavlik]

Not sure if this will help but here's a couple things I noticed.  In your original question, you have the word "Log" capitalized but in the syntax it is not.  Could that be why it's not working?  I also noticed that in your question the words "INFO" and "WARNING" are all capitalized but "Error" is not but you have it as "ERROR" in the syntax.  

I often have spelling mistakes in my code that I don't catch right away so thought I'd offer that up as a suggestion.  Good luck!

[bhavlik]

Wow!  That was so much easier than I thought! Thanks kind stranger.