Dashboards & Visualizations
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

What XML code can I use to change background color of stats table on dropdown field value?

Abhineet
Loves-to-Learn Everything
‎09-26-2022 05:42 AM

 

want to implement below mentioned red highlighted xml code in splunk dashboard source if dropdown field value is "db2_cloud2" for stats table.

<format type="color" field="REPLAY_LATENCY">
<colorPalette type="expression">if(value&gt;45,"#D93F3C","")</colorPalette>
</format>

Below mentioned is screenshot of Dashboard.

Abhineet_0-1664196088776.png

 

Labels (1)
Labels
0 Karma
Reply

kamlesh_vaghela
SplunkTrust
SplunkTrust
‎09-26-2022 07:08 AM

@Abhineet 

There is a trick to achieving this. Please check below sample XML.

<form version="1.1">
  <label>Table Cell Color</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tkn_drop">
      <label>tkn_drop</label>
      <choice value="db2_cloud2">db2_cloud2</choice>
      <choice value="db2_cloud1">db2_cloud1</choice>
      <change>
        <condition match="$form.tkn_drop$==&quot;db2_cloud2&quot;">
          <set token="mycolor">#D93F3C</set>
          <set token="mydummy">| rename comment as "Just Dummy"</set>
        </condition>
        <condition>
          <set token="mycolor"></set>
          <set token="mydummy">| rename comment as "Just another Dummy"</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$tkn_drop$</title>
      <table>
        <search>
          <query>| makeresults count=10 | eval data=1 | accum data | eval REPLAY_LATENCY=10*data $mydummy$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="REPLAY_LATENCY">
          <colorPalette type="expression">if(value&gt;45,"$mycolor$","")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

 

Screenshot 2022-09-26 at 7.37.34 PM.png

 

 

Screenshot 2022-09-26 at 7.38.13 PM.png

 

 

 I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

 

0 Karma
Reply

Abhineet
Loves-to-Learn Everything
‎09-26-2022 07:41 AM

Hi Kamlesh!

Thanks for response.

we have below mentioned conditions for Dashboard.

1. condition for "db2_principal" and "db2_copy2" dropdown value if "LATENCY" and "REPLAY_LATENCY" field  value greater than 15 minute it should be color coded to red.

2. condition for "db2_cloud2"  dropdown value if "LATENCY" and "REPLAY_LATENCY" field  value greater than 45 minute it should be color coded to red.

3. condition for "db2_cloud2"  dropdown value  no need to change color for "HADR_LOG_GAP_KB" and "STANDBY_RECV_REPLAY_GAP_KB" field value.

 

below mentioned is xml of my dashboard. can you make changes to xml as per above mentioned three condition.

<form version="1.1" theme="dark">
<label>Test</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>Dropdown</label>
<choice value="db2_principal">principal</choice>
<choice value="db2_copy2">copy2</choice>
<choice value="db2_cloud2">cloud</choice>
<default>db2_principal</default>
<initialValue>db2_principal</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>$field1$</title>
<table>
<title>Stats</title>
<search>
<query>index=db2hadr_index PRIMARY_LOG_TIME!="PRIMARY_LOG_TIME" sourcetype=$field1$| table PRIMARY_INSTANCE HADR_SYNCMODE HADR_STATE HADR_CONNECT_STATUS HADR_FLAGS LATENCY REPLAY_LATENCY STANDBY_SPOOL_PERCENT HADR_LOG_GAP_KB STANDBY_RECV_REPLAY_GAP_KB PRIMARY_LOG_TIME PRIMARY_LOG STANDBY_LOG</query>
<earliest>0</earliest>
<latest></latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color" field="HADR_STATE">
<colorPalette type="map">{"Disconnected":#D93F3C,"Remote catchup pending":#D93F3C,"Disconnected peer":#D93F3C}</colorPalette>
</format>
<format type="color" field="HADR_CONNECT_STATUS">
<colorPalette type="map">{"Disconnected":#D93F3C,"Congested":#FFA500}</colorPalette>
</format>
<format type="color" field="HADR_LOG_GAP_KB">
<colorPalette type="expression">if(value&gt;4194304,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="STANDBY_RECV_REPLAY_GAP_KB">
<colorPalette type="expression">if(value&gt;4194304,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="STANDBY_SPOOL_PERCENT">
<colorPalette type="expression">if(value&gt;50,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="LATENCY">
<colorPalette type="expression">if(value&gt;15,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="REPLAY_LATENCY">
<colorPalette type="expression">if(value&gt;15,"#D93F3C","")</colorPalette>
</format>
</table>
</panel>
</row>
</form>

 

 

0 Karma
Reply

kamlesh_vaghela
SplunkTrust
SplunkTrust
‎09-26-2022 08:36 AM

@Abhineet 

Can you please try this?

 

<form version="1.1" theme="dark">
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>Dropdown</label>
      <choice value="db2_principal">principal</choice>
      <choice value="db2_copy2">copy2</choice>
      <choice value="db2_cloud2">cloud</choice>
      <choice value="other">other</choice>
      <default>db2_principal</default>
      <initialValue>db2_principal</initialValue>
      <change>
        <condition match="$form.field1$==&quot;db2_principal&quot;">
          <set token="mycolor1">#D93F3C</set>
          <set token="mycolor2">#D93F3C</set>
          <set token="myMinute">15</set>
          <set token="mydummy">| rename comment as "Just Dummy 1"</set>
        </condition>
        <condition match="$form.field1$==&quot;db2_copy2&quot;">
          <set token="mycolor1">#D93F3C</set>
          <set token="mycolor2">#D93F3C</set>
          <set token="myMinute">15</set>
          <set token="mydummy">| rename comment as "Just Dummy 2"</set>
        </condition>
        <condition match="$form.field1$==&quot;db2_cloud2&quot;">
          <set token="mycolor1">#D93F3C</set>
          <set token="mycolor2"></set>
          <set token="myMinute">55</set>
          <set token="mydummy">| rename comment as "Just Dummy 3"</set>
        </condition>
        <condition>
          <set token="mycolor1"></set>
          <set token="mycolor2"></set>
          <set token="myMinute">No</set>
          <set token="mydummy">| rename comment as "Just another Dummy"</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$field1$---$mycolor2$</title>
      <table>
        <title>Stats</title>
        <search>
          <query>| makeresults count=10 
| eval data=1 
| accum data 
| eval REPLAY_LATENCY=10*data, LATENCY=10*data,HADR_LOG_GAP_KB=REPLAY_LATENCY*419430,STANDBY_RECV_REPLAY_GAP_KB=REPLAY_LATENCY*419430,HADR_STATE ="Disconnected",HADR_CONNECT_STATUS="Congested"
| table PRIMARY_INSTANCE HADR_SYNCMODE HADR_STATE HADR_CONNECT_STATUS HADR_FLAGS LATENCY REPLAY_LATENCY STANDBY_SPOOL_PERCENT HADR_LOG_GAP_KB STANDBY_RECV_REPLAY_GAP_KB PRIMARY_LOG_TIME PRIMARY_LOG STANDBY_LOG $mydummy$</query>
          <earliest>0</earliest>
          <latest></latest>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="totalsRow">false</option>
        <option name="wrap">false</option>
        <format type="color" field="HADR_STATE">
          <colorPalette type="map">{"Disconnected":#D93F3C,"Remote catchup pending":#D93F3C,"Disconnected peer":#D93F3C}</colorPalette>
        </format>
        <format type="color" field="HADR_CONNECT_STATUS">
          <colorPalette type="map">{"Disconnected":#D93F3C,"Congested":#FFA500}</colorPalette>
        </format>
        <format type="color" field="HADR_LOG_GAP_KB">
          <colorPalette type="expression">if(value&gt;4194304,"$mycolor2$","")</colorPalette>
        </format>
        <format type="color" field="STANDBY_RECV_REPLAY_GAP_KB">
          <colorPalette type="expression">if(value&gt;4194304,"$mycolor2$","")</colorPalette>
        </format>
        <format type="color" field="STANDBY_SPOOL_PERCENT">
          <colorPalette type="expression">if(value&gt;$myMinute$,"#D93F3C","")</colorPalette>
        </format>
        <format type="color" field="LATENCY">
          <colorPalette type="expression">if(value&gt;$myMinute$,"$mycolor1$","")</colorPalette>
        </format>
        <format type="color" field="REPLAY_LATENCY">
          <colorPalette type="expression">if(value&gt;$myMinute$,"#D93F3C","")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

 

 

Screenshot 2022-09-26 at 9.05.39 PM.png

 

Note:  Whatever code I'm sharing is for reference purposes. Please go through each line of code to get more understanding. 

I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Reply

Abhineet
Loves-to-Learn Everything
‎09-26-2022 09:06 AM

Hi Kamlesh!

It's working for me after making few changes.

Thanks for your help.

definitely will upvote you

0 Karma
Reply
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...
Top