Dashboards & Visualizations

My CollorPallete expression is not working when using LIKE

Bleepie
Communicator

Dear community,

When using a CollorPallete expression on a statistics table the following code works:

<format type="color" field="myField">
    <colorPalette type="expression">if (value == "DEBUG", "#f54242","#65A637") 
    </colorPalette>
</format>

#F54242 = RED

#65A637 = GREEN

Because the data in myField is not exactly "DEBUG" , the table collumns are all green.  So in order to make the collumns with "DEBUG" red and the rest green, I tried the following piece of code:

<format type="color" field="myField">
    <colorPalette type="expression">if (like(value,"%DEBUG%", "#f54242","#65A637")
    </colorPalette>
</format>

 

This piece of code is not working at all. I am trying to use the wildcard to find any occurance of "DEBUG" inside myField. Not only are the fields not red, they are not even green, making me think my code is incorrect. 

What am I doing wrong? 

Thanks.

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You need to close the brackets of the like function

if (like(value,"%DEBUG%"), "#f54242","#65A637")

If that doesn't work, try the match function.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to close the brackets of the like function

if (like(value,"%DEBUG%"), "#f54242","#65A637")

If that doesn't work, try the match function.

0 Karma

Bleepie
Communicator

Whoops. Small mistake. Got it working. Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...