Dashboards & Visualizations

Rows with same column value should be colored with same color

ektasardana
Explorer

Lets say I have a table with fields A, B, C, D. I would like to color rows based on the values of column D. Basically rows with same value of column D, should be in the same color. Is there a way this can be achieved in Splunk? Any help related to this will be appreciated!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ektasardana,
have you already seen the "Splunk 7.x Dashboard Examples" App? (see https://splunkbase.splunk.com/app/1603/ )
In this app you can find two examples that could help you.
bye.
Giuseppe

0 Karma

ektasardana
Explorer

Hi cusello,

Thank you for your response. I guess my problem here is a bit different from the one mentioned in the examples. Lets say column D has values "abc","bcd","abc","egg","bcd" so I would like to color row 1 and row 3 with color lets say red and row 2 and row 5 with color green. Also, I don't know the values of column D before hand.
How should I proceed in this case?

Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ektasardana,
in the first example of the "Table Formats" dashboard there's an example that give a color to a cell (not the full row) based on a different value of the cell (not numeric).

<format type="color" field="sourcetype">
   <colorPalette type="sharedList"></colorPalette>
   <scale type="category"></scale>
</format>

Probably using CSS and/or javascript (modifying table_row_highlighting.js) it's possible to put the same color in all the row, but i don't think that it's possible in simple XML.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...