Solved: SPL dynamic range

asabatini · ‎09-06-2024

Hi folks,

I have a quick question based on this kind of data.

consider this table

Age	sex	id	^N-S-Ba	S-N mm
17	male	1	125	84
17	female	2	133	75

I have to create a dynamic range for the field "S-N mm"
for the female is from 74,6 to 77

for the male is from 79,3 to 87,7
I need to create a table that when one of these values is within range it should turn green

thanks for the support

Ale

bowesmana · ‎09-06-2024

I'm assuming this is in a dashboard.

If you are using simple XML you can do this using the technique described in these links below. As you need to colour the cell based on dependency of data elsewhere (male/female) you need to calculate the colour you want in the SPL and then make the S-N mm field a multivalue field and then use the expression type of syntax.

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-color-of-row-based-on-ce...

https://community.splunk.com/t5/Dashboards-Visualizations/Changing-the-color-of-a-table-row-if-the-r...

https://community.splunk.com/t5/Dashboards-Visualizations/How-color-a-field-by-other-value-in-XML/m-...

View solution in original post

bowesmana · ‎09-06-2024

I'm assuming this is in a dashboard.

If you are using simple XML you can do this using the technique described in these links below. As you need to colour the cell based on dependency of data elsewhere (male/female) you need to calculate the colour you want in the SPL and then make the S-N mm field a multivalue field and then use the expression type of syntax.

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-color-of-row-based-on-ce...

https://community.splunk.com/t5/Dashboards-Visualizations/Changing-the-color-of-a-table-row-if-the-r...

https://community.splunk.com/t5/Dashboards-Visualizations/How-color-a-field-by-other-value-in-XML/m-...

asabatini · ‎09-06-2024

Hi @bowesmana

I tried our suggestion but doesn't works maybe I wrong something?

<dashboard version="1.1" theme="light">
  <label>ID patient</label>
  <row>
    <panel>
      <html depends="$hidden$">
        <style>
          #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="0"]{
            display: none;
          }
        </style>
      </html>
      <table id="coloured_cell">
        <search>
          <query>sourcetype=csv 
| eval value=mvappend(sex,'S_N mm')
| table Age id sex "S_N mm" N_S_Ba value</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="id"></format>
        <format type="color" field="value">
          <colorPalette type="expression">case(mvindex(value, 1) &gt;"79" AND mvindex(value, 0) == "male","#00FF00")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

ITWhisperer · ‎09-07-2024

As @bowesmana said (and does the articles he referenced, and many others on this subject), your calculation to determine the colour should be done in SPL, so try modifying your search accordingly.

asabatini · ‎09-07-2024

Hi @bowesmana , @ITWhisperer ,

Ok this method works fine, I'll explain what I did.

first I created a multivalue field with "sex, and S_n_mm" fields.

| eval value=mvappend(sex,'S_N mm')

after this I created the condition directly on the XML code dashboard.

<format type="color" field="value">
          <colorPalette type="expression">case(mvindex(value, 1) &gt;"79" AND mvindex(value, 0) == "male","#00FF00",mvindex(value, 1) &gt;"74" AND mvindex(value, 0) == "female","#00FF00")</colorPalette>
        </format>

SPL dynamic range

eval

fields

lookup

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Enterprise Security Content Update (ESCU) | New Releases

Index This | Divide 100 by half. What do you get?