Dashboards & Visualizations

How to use a variable in colorpalette expression in SimpleXML?

Bleepie
Communicator

Dear Splunk community,

How do I use a variable inside a colorpallete expression using SimpleXML? I have the following:

 

mySearch | eval myField = 100

 

If I have a table that returns rows with numbers in them, I can change the color of that row doing so:

 

<format type="color" field="sourceField">
    <colorPalette type="expression">if (value > myField ,"#df5065","#00FF00")</colorPalette>
</format>

 

Expectation: Any row above 100 is red (df5065) and all other fields are green (00FF00).

Result: All rows are green

I need to use myField to calculate with. How do I do that?

I have tried:

 

$myField$
'myField'
(myField)

 

None work.

Thanks in advance.

Labels (5)
0 Karma

renjith_nair
Legend

You can set the scaling threshold directly in the table visualization.

Try this run anywhere example and see if it fits.

<dashboard>
  <label>Color Palette Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
          <scale type="threshold">100</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Bleepie
Communicator

This seems to be a treshold that is fixed (at 100). I want to use my variable because its non-fixed. Is that possible?

0 Karma

renjith_nair
Legend

Yes, try this

Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well

<form>
  <label>Color Palette Token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="threshold" searchWhenChanged="true">
      <label>Threshold</label>
      <choice value="100">100</choice>
      <choice value="200">200</choice>
      <choice value="300">300</choice>
      <choice value="500">500</choice>
      <choice value="800">800</choice>
      <choice value="1000">1000</choice>
      <default>100</default>
      <initialValue>100</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$threshold$</title>
      <table>
        <search>
          <query>| makeresults count=10|eval threshold=$threshold$
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="expression">if(value &gt; $threshold$, "#DC4E41", "#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...