Dashboards & Visualizations

Need help to color code cells

Mrig342
Contributor

Hi,

I am trying color code App_State cells based on it state in the below table.

App_Name    App_State
abc                Running
cde                Stopped 
fgh                 Running
xyz                Running
mnp              Stopped

In the dashboard Source:

<dashboard theme="dark" refresh="30">
<label>ABC</label>
<row>
<panel>
<table>
<search>
<query>index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?&lt;App_Name&gt;\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?&lt;App_State&gt;[\w+\s]+)\sNumber" | table App_Name,App_State</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="App_State">
<colorPalette type="map">{"Running":#53a051,"Stopped":#dc4e41}</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

But I am not getting any colors in the cells. Can someone please look into it and help me get the cells with desired colors..?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure if this will help given the logs you shared seem to fit your pattern anyway, but this should remove any trailing space there might have been

| rex field=_raw "(?ms)Sync\sState\s:\s(?&lt;App_State&gt;[\w\s]+\w)\s+Number"

The format clause looks like it should work too.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Given that the app states are single words, do you need the +\s in the rex? Perhaps you are ending up with a trailing space which then won't match your colour map?

Mrig342
Contributor

Hi ITWhisperer,

Thanks for your prompt response.

Actually the app states are not single words. It can be as App_State=Partially stopped. So I have used it.

If that's the issue then can you please help me with the rex command to extract it in in the desired way.

Below are the logs:

log1: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Not running Synchronization : In Sync State : Stopped Number of template version : 6

log2: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Running Synchronization : Out of Sync State : Partially stopped Number of template version : 6

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure if this will help given the logs you shared seem to fit your pattern anyway, but this should remove any trailing space there might have been

| rex field=_raw "(?ms)Sync\sState\s:\s(?&lt;App_State&gt;[\w\s]+\w)\s+Number"

The format clause looks like it should work too.

Mrig342
Contributor

Hi ITWhisperer,

It worked..!! I can now see the cells in colors as desired.

Thank you very much for your support...!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...