I am very new to splunk, so I have a csv which which i want to show as a table in splunk and i did it using the table command, now i want to have a dropdown based on IDs column and when someone select any ID value from dropdown table should only show the selected ID rows.
Secondly i want to change the color of the GAC_percent column cells based on their value such as if GAC_percent > 90.00% , cell color should be green. Any help is much appreciated. Thanks
IDs | Drop | Features | GAC_percent | GAC | |
A | 2004 | 11 P, 1 B for 2004 Trend | 97.51% | g | |
A | 2003 | 11 P, 1 B for 2003 Trend | 88.00% | y | |
B | 2003 | 12 P, 10B for 2003 Trend | 89.00% | y | |
B | 2004 | 3 P, 2 B for 20Q4 Trend | 97.51% | g |
sample:
<form>
<label>sample table fm CSV</label>
<search id="base">
<query>| makeresults
| eval _raw="IDs,Drop,Features,GAC_percent,GAC
A,2004,11 P# 1 B for 2004 Trend,97.51%,g
A,2003,11 P# 1 B for 2003 Trend,88.00%,y
B,2003,12 P# 10B for 2003 Trend,89.00%,y
B,2004,3 P# 2 B for 20Q4 Trend,97.51%,g"
| multikv forceheader=1
| table IDs,Drop,Features,GAC_percent,GAC</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="ID_token">
<label>IDs</label>
<fieldForLabel>IDs</fieldForLabel>
<fieldForValue>IDs</fieldForValue>
<search base="base">
<query>| dedup IDs</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base">
<query>| eval Features=replace(Features,"#",",")
| eval GAC_percent=rtrim(GAC_percent,"%")
| search IDs=$ID_token$</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="number" field="GAC_percent">
<option name="unit">%</option>
</format>
<format type="color" field="GAC_percent">
<colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">90</scale>
</format>
</table>
</panel>
</row>
</form>
Please use following:
<search id="base">
<query>| inputlookup your_csv
| table IDs,Drop,Features,GAC_percent,GAC</query>
hi really thanks for the help but i am not sure about the inputllookup how i am getting data is
index ="abc" source ="aa"|table "IDs",... so on
can u help now? Thanks