How to use a variable in colorpalette expression in SimpleXML?

[Bleepie]

Dear Splunk community,

How do I use a variable inside a colorpallete expression using SimpleXML? I have the following:

mySearch | eval myField = 100

If I have a table that returns rows with numbers in them, I can change the color of that row doing so:

<format type="color" field="sourceField">
    <colorPalette type="expression">if (value > myField ,"#df5065","#00FF00")</colorPalette>
</format>

Expectation: Any row above 100 is red (df5065) and all other fields are green (00FF00).

Result: All rows are green

I need to use myField to calculate with. How do I do that?

I have tried:

$myField$
'myField'
(myField)

None work.

Thanks in advance.

[renjith_nair]

You can set the scaling threshold directly in the table visualization.

Try this run anywhere example and see if it fits.

<dashboard>
  <label>Color Palette Token</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
          <scale type="threshold">100</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

[Bleepie]

This seems to be a treshold that is fixed (at 100). I want to use my variable because its non-fixed. Is that possible?

[renjith_nair]

Yes, try this

Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well

<form>
  <label>Color Palette Token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="threshold" searchWhenChanged="true">
      <label>Threshold</label>
      <choice value="100">100</choice>
      <choice value="200">200</choice>
      <choice value="300">300</choice>
      <choice value="500">500</choice>
      <choice value="800">800</choice>
      <choice value="1000">1000</choice>
      <default>100</default>
      <initialValue>100</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$threshold$</title>
      <table>
        <search>
          <query>| makeresults count=10|eval threshold=$threshold$
| eval value=(random() % 1000) + 1</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="value">
          <colorPalette type="expression">if(value &gt; $threshold$, "#DC4E41", "#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>