Dashboards & Visualizations

In Dashboard Studio, how to color code one table column based on value of hidden column.

edgarrity
Path Finder

The following Dashboard Studio code will display a three-column table with the last column color coded by the value of the last column.  How do I color code the second column by the value of the last column and hide the last column?

{
	"visualizations": {
		"viz_mGj9tW8N": {
			"type": "splunk.table",
			"dataSources": {
				"primary": "ds_EKJuCMzj"
			},
			"title": "Product List",
			"description": "Current prouct versions",
			"options": {
				"columnFormat": {
					"color_key": {
						"data": "> table | seriesByName(\"color_key\") | formatByType(color_keyColumnFormatEditorConfig)",
						"rowColors": "> table | seriesByName('color_key') | rangeValue(color_keyRowColorsEditorConfig)"
					}
				}
			},
			"context": {
				"color_keyColumnFormatEditorConfig": {
					"number": {
						"thousandSeparated": false,
						"unitPosition": "after"
					}
				},
				"color_keyRowColorsEditorConfig": [
					{
						"to": 20,
						"value": "#D41F1F"
					},
					{
						"from": 20,
						"to": 40,
						"value": "#D94E17"
					},
					{
						"from": 40,
						"to": 60,
						"value": "#CBA700"
					},
					{
						"from": 60,
						"to": 80,
						"value": "#669922"
					},
					{
						"from": 80,
						"value": "#118832"
					}
				]
			}
		}
	},
	"dataSources": {
		"ds_EKJuCMzj": {
			"type": "ds.search",
			"options": {
				"query": "| makeresults \r\n| eval Product = \"Circle\" \r\n| eval Version = \"1.2.3.4\" \r\n| eval color_key = 52 \r\n| eval _time=relative_time(now(), \"-1d@d\") \r\n| append \r\n    [| makeresults \r\n    | eval Product = \"Square\" \r\n    | eval Version = \"2.3.4.5\" \r\n    | eval color_key = 48 \r\n    | eval _time=relative_time(now(), \"-1d@d\") \r\n        ] \r\n| append \r\n    [| makeresults \r\n    | eval Product = \"Triangle\" \r\n    | eval Version = \"3.4.5.6\"\r\n    | eval color_key = 75 \r\n    | eval _time=relative_time(now(), \"-1d@d\") \r\n        ] \r\n| append \r\n    [| makeresults \r\n    | eval Product = \"Rectangle\" \r\n    | eval Version = \"4.5.6.7\" \r\n    | eval color_key = 4 \r\n    | eval _time=relative_time(now(), \"-1d@d\") \r\n        ] \r\n| append \r\n    [| makeresults \r\n    | eval Product = \"Oval\" \r\n    | eval Version = \"5.6.7.8\" \r\n    | eval color_key = 2 \r\n    | eval _time=relative_time(now(), \"-1d@d\") \r\n        ] \r\n| stats latest(Version) as Version latest(color_key) as color_key by Product",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Product List"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {},
	"layout": {
		"type": "absolute",
		"options": {
			"display": "auto-scale"
		},
		"structure": [
			{
				"item": "viz_mGj9tW8N",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 340,
					"h": 300
				}
			}
		],
		"globalInputs": []
	},
	"description": "",
	"title": "Dynamic Coloring POC - SPLK-1271"
}

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...