Dashboards & Visualizations

Table colouring by overall range

PickleRick
SplunkTrust
SplunkTrust

I'm a bit confused.

I tried to colour one of the columns in my table by the range of values in that table.

And it works.

Almost.

The problem is that colouring works separately for each page of results which is a bit ridiculous.

PickleRick_0-1636554258325.png

PickleRick_1-1636554265023.png

 

These are two pages from the same search. Kinda ridiculous, isn't it?

Is it that I'm doing something wrong? But it seems that there's no simpler way than chose "range", preset...

But how to make it work across whole results range (so my first screen shoud be mostly orange-ish (sorry, don't know how this colour is called in english), and the second should be blue)?

Labels (1)
0 Karma

soumyasaha25
Contributor

I am guessing you have used the Color settings with mode "scale" set to the Presets - divergent 

something like this:

soumyasaha25_1-1636556736813.png

so this applies the settings dynamically as you move to the later pages - page 1 vs page 13 in your screenshots. So this color scale maps the colors as  per the values in each page.

What you could do is:

option 1. Set some static ranges and associated color for them like below

soumyasaha25_0-1636556699300.png

option 2.  you could define a "custom" scale (as you did already) but define some sort of static range by specifying min, midpoint and max values for the logcount number

soumyasaha25_2-1636557487704.png

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yeah, I know of those options but they each require me to input fixed values. That's the point.

If I can't help it, I'll have to do a dynamically created field used just for colouring and just hide it in the dashboard (won't work in a "normal" report) but it's not a very pretty solution.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...