Dashboards & Visualizations

How to use a variable in colorpalette expression in SimpleXML?

Bleepie
Communicator

Dear Splunk community,

How do I use a variable inside a colorpallete expression using SimpleXML? I have the following:

 

mySearch | eval myField = 100

 

If I have a table that returns rows with numbers in them, I can change the color of that row doing so:

 

<format type="color" field="sourceField">
    <colorPalette type="expression">if (value > myField ,"#df5065","#00FF00")</colorPalette>
</format>

 

Expectation: Any row above 100 is red (df5065) and all other fields are green (00FF00).

Result: All rows are green

I need to use myField to calculate with. How do I do that?

I have tried:

 

$myField$
'myField'
(myField)

 

None work.

Thanks in advance.

Labels (5)
0 Karma

renjith_nair
Legend

You can set the scaling threshold directly in the table visualization.

Try this run anywhere example and see if it fits.

<dashboard>
  <label>Color Palette Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
          <scale type="threshold">100</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Bleepie
Communicator

This seems to be a treshold that is fixed (at 100). I want to use my variable because its non-fixed. Is that possible?

0 Karma

renjith_nair
Legend

Yes, try this

Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well

<form>
  <label>Color Palette Token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="threshold" searchWhenChanged="true">
      <label>Threshold</label>
      <choice value="100">100</choice>
      <choice value="200">200</choice>
      <choice value="300">300</choice>
      <choice value="500">500</choice>
      <choice value="800">800</choice>
      <choice value="1000">1000</choice>
      <default>100</default>
      <initialValue>100</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$threshold$</title>
      <table>
        <search>
          <query>| makeresults count=10|eval threshold=$threshold$
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="expression">if(value &gt; $threshold$, "#DC4E41", "#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...