Why doesn't this if statement work for field coloring?

[tkwaller1]

I have an if statement in my dashboard code but it doesnt work and I have no idea why. Heres the code:

<row>
    <panel>
      <title>Submission Details</title>
      <table>
        <search>
          <query>index=my_db sourcetype="my:details"
| fillnull value="NA"  ID INT_MESSAGE_ID APPLICATION_NUMBER APPLICATION_TYPE SUBMISSION_NUMBER SUBMISSION_TYPE SUPPORTING_DOC_NUMBER GLOBAL_ID DUNS FEI PROJECT_ID MESSAGE_STATUS MESSAGE_COMMENT LAST_UPDATE_TIMESTAMP 
| stats count by ID INT_MESSAGE_ID APPLICATION_NUMBER APPLICATION_TYPE SUBMISSION_NUMBER SUBMISSION_TYPE SUPPORTING_DOC_NUMBER GLOBAL_ID DUNS FEI PROJECT_ID MESSAGE_STATUS MESSAGE_COMMENT LAST_UPDATE_TIMESTAMP 
| fields - count
| sort -INT_MESSAGE_ID</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="MESSAGE_STATUS">
          <colorPalette type="expression">if (MESSAGE_COMMENT == "Processed", "#53A051", "#DC4E41")</colorPalette>
        </format>
      </table>
    </panel>
  </row>

[PickleRick]

I don't think you can simply colour one column's cell based on another column value with expression. With the expression color palette type you can only reference value of the cell you're colouring.

[tkwaller1]

I tried this just to test, 

<format type="color" field="MESSAGE_COMMENT">
          <colorPalette type="expression">if (MESSAGE_COMMENT="Processed","#53A051","#DC4E41") </colorPalette>
        </format>

It only colors the else portion. Like nothing meets the first condition. Even though 80% of my records are "Processed"

[PickleRick · Accepted solution]

Yes. As I said, you can only refer to the value of the cell using the "value" argument. So you could use

if (value=="something", "#000000","#ffffff")

But that's not what you want because this colours a cell based on this cell's value, not other column.

Unfortunately the only way to do so is using external JS and CSS.

You can see how it's done in Dashboard Examples app https://splunkbase.splunk.com/app/1603

[tkwaller1]

Thanks,  sorry for not understanding hahaha. I follow now.

Thats exactly what I was looking for. It works now.