Dashboards & Visualizations

Table colouring by overall range

PickleRick
SplunkTrust
SplunkTrust

I'm a bit confused.

I tried to colour one of the columns in my table by the range of values in that table.

And it works.

Almost.

The problem is that colouring works separately for each page of results which is a bit ridiculous.

PickleRick_0-1636554258325.png

PickleRick_1-1636554265023.png

 

These are two pages from the same search. Kinda ridiculous, isn't it?

Is it that I'm doing something wrong? But it seems that there's no simpler way than chose "range", preset...

But how to make it work across whole results range (so my first screen shoud be mostly orange-ish (sorry, don't know how this colour is called in english), and the second should be blue)?

Labels (1)
0 Karma

soumyasaha25
Contributor

I am guessing you have used the Color settings with mode "scale" set to the Presets - divergent 

something like this:

soumyasaha25_1-1636556736813.png

so this applies the settings dynamically as you move to the later pages - page 1 vs page 13 in your screenshots. So this color scale maps the colors as  per the values in each page.

What you could do is:

option 1. Set some static ranges and associated color for them like below

soumyasaha25_0-1636556699300.png

option 2.  you could define a "custom" scale (as you did already) but define some sort of static range by specifying min, midpoint and max values for the logcount number

soumyasaha25_2-1636557487704.png

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yeah, I know of those options but they each require me to input fixed values. That's the point.

If I can't help it, I'll have to do a dynamically created field used just for colouring and just hide it in the dashboard (won't work in a "normal" report) but it's not a very pretty solution.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...