Dashboards & Visualizations

How to use a variable in colorpalette expression in SimpleXML?

Bleepie
Communicator

Dear Splunk community,

How do I use a variable inside a colorpallete expression using SimpleXML? I have the following:

 

mySearch | eval myField = 100

 

If I have a table that returns rows with numbers in them, I can change the color of that row doing so:

 

<format type="color" field="sourceField">
    <colorPalette type="expression">if (value > myField ,"#df5065","#00FF00")</colorPalette>
</format>

 

Expectation: Any row above 100 is red (df5065) and all other fields are green (00FF00).

Result: All rows are green

I need to use myField to calculate with. How do I do that?

I have tried:

 

$myField$
'myField'
(myField)

 

None work.

Thanks in advance.

Labels (5)
0 Karma

renjith_nair
Legend

You can set the scaling threshold directly in the table visualization.

Try this run anywhere example and see if it fits.

<dashboard>
  <label>Color Palette Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
          <scale type="threshold">100</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Bleepie
Communicator

This seems to be a treshold that is fixed (at 100). I want to use my variable because its non-fixed. Is that possible?

0 Karma

renjith_nair
Legend

Yes, try this

Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well

<form>
  <label>Color Palette Token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="threshold" searchWhenChanged="true">
      <label>Threshold</label>
      <choice value="100">100</choice>
      <choice value="200">200</choice>
      <choice value="300">300</choice>
      <choice value="500">500</choice>
      <choice value="800">800</choice>
      <choice value="1000">1000</choice>
      <default>100</default>
      <initialValue>100</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$threshold$</title>
      <table>
        <search>
          <query>| makeresults count=10|eval threshold=$threshold$
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="expression">if(value &gt; $threshold$, "#DC4E41", "#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...