want to implement below mentioned red highlighted xml code in splunk dashboard source if dropdown field value is "db2_cloud2" for stats table.
<format type="color" field="REPLAY_LATENCY">
<colorPalette type="expression">if(value>45,"#D93F3C","")</colorPalette>
</format>
Below mentioned is screenshot of Dashboard.
There is a trick to achieving this. Please check below sample XML.
<form version="1.1">
<label>Table Cell Color</label>
<fieldset submitButton="false">
<input type="dropdown" token="tkn_drop">
<label>tkn_drop</label>
<choice value="db2_cloud2">db2_cloud2</choice>
<choice value="db2_cloud1">db2_cloud1</choice>
<change>
<condition match="$form.tkn_drop$=="db2_cloud2"">
<set token="mycolor">#D93F3C</set>
<set token="mydummy">| rename comment as "Just Dummy"</set>
</condition>
<condition>
<set token="mycolor"></set>
<set token="mydummy">| rename comment as "Just another Dummy"</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>$tkn_drop$</title>
<table>
<search>
<query>| makeresults count=10 | eval data=1 | accum data | eval REPLAY_LATENCY=10*data $mydummy$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="REPLAY_LATENCY">
<colorPalette type="expression">if(value>45,"$mycolor$","")</colorPalette>
</format>
</table>
</panel>
</row>
</form>
I hope this will help you.
Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hi Kamlesh!
Thanks for response.
we have below mentioned conditions for Dashboard.
1. condition for "db2_principal" and "db2_copy2" dropdown value if "LATENCY" and "REPLAY_LATENCY" field value greater than 15 minute it should be color coded to red.
2. condition for "db2_cloud2" dropdown value if "LATENCY" and "REPLAY_LATENCY" field value greater than 45 minute it should be color coded to red.
3. condition for "db2_cloud2" dropdown value no need to change color for "HADR_LOG_GAP_KB" and "STANDBY_RECV_REPLAY_GAP_KB" field value.
below mentioned is xml of my dashboard. can you make changes to xml as per above mentioned three condition.
<form version="1.1" theme="dark">
<label>Test</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>Dropdown</label>
<choice value="db2_principal">principal</choice>
<choice value="db2_copy2">copy2</choice>
<choice value="db2_cloud2">cloud</choice>
<default>db2_principal</default>
<initialValue>db2_principal</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>$field1$</title>
<table>
<title>Stats</title>
<search>
<query>index=db2hadr_index PRIMARY_LOG_TIME!="PRIMARY_LOG_TIME" sourcetype=$field1$| table PRIMARY_INSTANCE HADR_SYNCMODE HADR_STATE HADR_CONNECT_STATUS HADR_FLAGS LATENCY REPLAY_LATENCY STANDBY_SPOOL_PERCENT HADR_LOG_GAP_KB STANDBY_RECV_REPLAY_GAP_KB PRIMARY_LOG_TIME PRIMARY_LOG STANDBY_LOG</query>
<earliest>0</earliest>
<latest></latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color" field="HADR_STATE">
<colorPalette type="map">{"Disconnected":#D93F3C,"Remote catchup pending":#D93F3C,"Disconnected peer":#D93F3C}</colorPalette>
</format>
<format type="color" field="HADR_CONNECT_STATUS">
<colorPalette type="map">{"Disconnected":#D93F3C,"Congested":#FFA500}</colorPalette>
</format>
<format type="color" field="HADR_LOG_GAP_KB">
<colorPalette type="expression">if(value>4194304,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="STANDBY_RECV_REPLAY_GAP_KB">
<colorPalette type="expression">if(value>4194304,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="STANDBY_SPOOL_PERCENT">
<colorPalette type="expression">if(value>50,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="LATENCY">
<colorPalette type="expression">if(value>15,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="REPLAY_LATENCY">
<colorPalette type="expression">if(value>15,"#D93F3C","")</colorPalette>
</format>
</table>
</panel>
</row>
</form>
Can you please try this?
<form version="1.1" theme="dark">
<label>Test</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>Dropdown</label>
<choice value="db2_principal">principal</choice>
<choice value="db2_copy2">copy2</choice>
<choice value="db2_cloud2">cloud</choice>
<choice value="other">other</choice>
<default>db2_principal</default>
<initialValue>db2_principal</initialValue>
<change>
<condition match="$form.field1$=="db2_principal"">
<set token="mycolor1">#D93F3C</set>
<set token="mycolor2">#D93F3C</set>
<set token="myMinute">15</set>
<set token="mydummy">| rename comment as "Just Dummy 1"</set>
</condition>
<condition match="$form.field1$=="db2_copy2"">
<set token="mycolor1">#D93F3C</set>
<set token="mycolor2">#D93F3C</set>
<set token="myMinute">15</set>
<set token="mydummy">| rename comment as "Just Dummy 2"</set>
</condition>
<condition match="$form.field1$=="db2_cloud2"">
<set token="mycolor1">#D93F3C</set>
<set token="mycolor2"></set>
<set token="myMinute">55</set>
<set token="mydummy">| rename comment as "Just Dummy 3"</set>
</condition>
<condition>
<set token="mycolor1"></set>
<set token="mycolor2"></set>
<set token="myMinute">No</set>
<set token="mydummy">| rename comment as "Just another Dummy"</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>$field1$---$mycolor2$</title>
<table>
<title>Stats</title>
<search>
<query>| makeresults count=10
| eval data=1
| accum data
| eval REPLAY_LATENCY=10*data, LATENCY=10*data,HADR_LOG_GAP_KB=REPLAY_LATENCY*419430,STANDBY_RECV_REPLAY_GAP_KB=REPLAY_LATENCY*419430,HADR_STATE ="Disconnected",HADR_CONNECT_STATUS="Congested"
| table PRIMARY_INSTANCE HADR_SYNCMODE HADR_STATE HADR_CONNECT_STATUS HADR_FLAGS LATENCY REPLAY_LATENCY STANDBY_SPOOL_PERCENT HADR_LOG_GAP_KB STANDBY_RECV_REPLAY_GAP_KB PRIMARY_LOG_TIME PRIMARY_LOG STANDBY_LOG $mydummy$</query>
<earliest>0</earliest>
<latest></latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color" field="HADR_STATE">
<colorPalette type="map">{"Disconnected":#D93F3C,"Remote catchup pending":#D93F3C,"Disconnected peer":#D93F3C}</colorPalette>
</format>
<format type="color" field="HADR_CONNECT_STATUS">
<colorPalette type="map">{"Disconnected":#D93F3C,"Congested":#FFA500}</colorPalette>
</format>
<format type="color" field="HADR_LOG_GAP_KB">
<colorPalette type="expression">if(value>4194304,"$mycolor2$","")</colorPalette>
</format>
<format type="color" field="STANDBY_RECV_REPLAY_GAP_KB">
<colorPalette type="expression">if(value>4194304,"$mycolor2$","")</colorPalette>
</format>
<format type="color" field="STANDBY_SPOOL_PERCENT">
<colorPalette type="expression">if(value>$myMinute$,"#D93F3C","")</colorPalette>
</format>
<format type="color" field="LATENCY">
<colorPalette type="expression">if(value>$myMinute$,"$mycolor1$","")</colorPalette>
</format>
<format type="color" field="REPLAY_LATENCY">
<colorPalette type="expression">if(value>$myMinute$,"#D93F3C","")</colorPalette>
</format>
</table>
</panel>
</row>
</form>
Note: Whatever code I'm sharing is for reference purposes. Please go through each line of code to get more understanding.
I hope this will help you.
Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hi Kamlesh!
It's working for me after making few changes.
Thanks for your help.
definitely will upvote you