Dear Splunk community,
How do I use a variable inside a colorpallete expression using SimpleXML? I have the following:
mySearch | eval myField = 100
If I have a table that returns rows with numbers in them, I can change the color of that row doing so:
<format type="color" field="sourceField">
<colorPalette type="expression">if (value > myField ,"#df5065","#00FF00")</colorPalette>
</format>
Expectation: Any row above 100 is red (df5065) and all other fields are green (00FF00).
Result: All rows are green
I need to use myField to calculate with. How do I do that?
I have tried:
$myField$
'myField'
(myField)
None work.
Thanks in advance.
You can set the scaling threshold directly in the table visualization.
Try this run anywhere example and see if it fits.
<dashboard>
<label>Color Palette Token</label>
<row>
<panel>
<table>
<search>
<query>| makeresults count=10
| eval value=(random() % 1000) + 1</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="value">
<colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">100</scale>
</format>
</table>
</panel>
</row>
</dashboard>
This seems to be a treshold that is fixed (at 100). I want to use my variable because its non-fixed. Is that possible?
Yes, try this
Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well
<form>
<label>Color Palette Token</label>
<fieldset submitButton="false">
<input type="dropdown" token="threshold" searchWhenChanged="true">
<label>Threshold</label>
<choice value="100">100</choice>
<choice value="200">200</choice>
<choice value="300">300</choice>
<choice value="500">500</choice>
<choice value="800">800</choice>
<choice value="1000">1000</choice>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>$threshold$</title>
<table>
<search>
<query>| makeresults count=10|eval threshold=$threshold$
| eval value=(random() % 1000) + 1</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $threshold$, "#DC4E41", "#53A051")</colorPalette>
</format>
</table>
</panel>
</row>
</form>