Dashboards & Visualizations

My CollorPallete expression is not working when using LIKE

Bleepie
Communicator

Dear community,

When using a CollorPallete expression on a statistics table the following code works:

<format type="color" field="myField">
    <colorPalette type="expression">if (value == "DEBUG", "#f54242","#65A637") 
    </colorPalette>
</format>

#F54242 = RED

#65A637 = GREEN

Because the data in myField is not exactly "DEBUG" , the table collumns are all green.  So in order to make the collumns with "DEBUG" red and the rest green, I tried the following piece of code:

<format type="color" field="myField">
    <colorPalette type="expression">if (like(value,"%DEBUG%", "#f54242","#65A637")
    </colorPalette>
</format>

 

This piece of code is not working at all. I am trying to use the wildcard to find any occurance of "DEBUG" inside myField. Not only are the fields not red, they are not even green, making me think my code is incorrect. 

What am I doing wrong? 

Thanks.

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You need to close the brackets of the like function

if (like(value,"%DEBUG%"), "#f54242","#65A637")

If that doesn't work, try the match function.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to close the brackets of the like function

if (like(value,"%DEBUG%"), "#f54242","#65A637")

If that doesn't work, try the match function.

0 Karma

Bleepie
Communicator

Whoops. Small mistake. Got it working. Thanks!

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...