Splunk dashboard table - how to add colors based on Threshold values for Dynamic column names?

[shashankk]

Hello Team

I am having a Dashboard created with below Table output. The table is having a dynamic column names (in Date format)

Output as below:

TestMQ	2023-06-23	2023-06-22	2023-06-21	2023-06-20	2023-06-19	2023-06-18	2023-06-17	2023-06-16	And so on - till 30 days
MQ.NAME	5.03	17.04	25.75	19.82	32.14	56.81	10.91	85.14	....

My requirement is to color code these values based on the threshold condition as "[<60 = Green] | [>85 = Red] | [>60 AND <85 = Amber]"

I am new to Splunk and still learning. Kindly suggest how this can be achieved i.e. to modify the dynamic Column values based on the Threshold conditions.

@ITWhisperer

[shashankk]

@ITWhisperer - Do you have any suggestions on this please? 

• Are we suppose to Hard code all possible values and specify the Threshold condition? 
• How do we use wildcard search here which will apply to all possible Date format values ?
  
  Example below:
  
  Date Format: 2023-06-27
  
  <format type="color" field="202*-*-*">
  <colorPalette type="list">[#53A051,#F1813F,#DC4E41]</colorPalette>
  <scale type="threshold">60,85</scale>
  </format>

[ITWhisperer · Accepted solution]

Try removing field so that it applies to all fields.

[shashankk]

@ITWhisperer - Thank you - this works fine! 🙂

[dural_yyz]

Formatting columns with color is answered here:

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-color-table-cell-on-dashboard-based...

They referenced the document link here:

http://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML

You want to do column color formats for dynamically named columns which does not appear possible based upon current documentation for xml dashboards.  In the table settings the color tablet is applied at the field name level.  A dynamically named field can not be accounted for unless you were to hard code all possible options.