Dashboards & Visualizations

Is there an If elseIf feature I can use for determining what color to make a cell in the color format rule?

splunkhelp123
New Member

Is there an If elseIf feature I can use for determining what color to make a cell using collorPalette?

i'm looking for something like

     <format type="color" field="msg">
      <colorPalette type="expression"> 


      if (like(value,"%something%")  OR like(value,"%something1%"), "#008000", "#FFFFFF") 
      elseIf (like(value,"%something2%")  OR like(value,"something3"), "#FF6347", "#FFFFFF")

      </colorPalette>
    </format>
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@splunkhelp123

Can you please try below XML?

<format type="color" field="data">
          <colorPalette type="expression">case(value=="something" OR value=="something1","#008000",value=="something2" OR value=="something3","#FF6347",1=1,"#FFFFFF")</colorPalette>
       </format>

If you have multiple if conditions then it is better to use case.So I have used case instead of if. I have provided a simple direct comparison with data.

My Sample Dashboard:

<dashboard>
  <label>colorPalette</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval data="something,something1,something2,something3,somethin4" | eval data=split(data,",") |mvexpand data</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="data">
          <!--colorPalette type="expression">case(match(value,"something") OR match(value,"something1"),"#008000",match(value,"something2") OR match(value,"something3"),"#FF6347",1=1,"#FFFFFF")</colorPalette-->
          <colorPalette type="expression">case(value=="something" OR value=="something1","#008000",value=="something2" OR value=="something3","#FF6347",1=1,"#FFFFFF")</colorPalette>
       </format>
      </table>
    </panel>
  </row>
</dashboard>

Thanks

kamlesh_vaghela
SplunkTrust
SplunkTrust

Here, I have commented on a match expression.bcoz it will match the first condition always. You can try it by uncommenting it.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!