Dashboards & Visualizations

change background color of single value viz Trellis showing multiple values based on one field value ?

pgadhari
Builder

I have a query whose one of the field named system is having values BMS or CCTV (total 10 fields are there in table format ) and I am showing the fields for those system in a table format and using the single value viz to show the values in the trellis format. I have applied some CSS to customize trellis. Now, I want to show that if System=BMS then all background color of all trellis fields should be changed to GREEN and if System=CCTV, then it should be changed to "AMBER", as if I have to show the whole row as GREEN or AMBER based on "System" field value. Also some field values are text and some are date along with numeric values, as attached in the image.

My query is same, and I am just passing $token$ to select the Division based on which the value of "System" field changes ( in this case either BMS or CCTV). I tried using status indicator app, but somehow the trellis is not showing values for the fields in that, and hence I used "single value" viz. Attached are the images for your reference :

My query is like below :

.... | sort - Total | sort - Division | search Division=SAS | fields - Full_Name Division | search System=CCTV OR System=BMS

where Division value is a token, when Division=SAS, then it returns System=CCTV and when Division=FM, it returns row System=BMS ?

So, when System value is CCTV, the whole row background color should be GREEN and for System=BMS the background color should be AMBER and that too it should be in "single value" viz using trellis layout ? How can I achieve this ?

![alt text][2] [2]: /storage/temp/290867-query-output-table.png

Labels (2)
0 Karma
1 Solution

niketn
Legend

Hi @pgadhari please try the following approach:

Step 1 Use one of my old answers to color table row based on expression (SimpleXML with CSS, but you can use JS as well): https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html

Step 2 Then use the other answer to format the table as Single Value as per this answer: https://answers.splunk.com/answers/529004/is-there-a-way-to-display-more-than-20-charts-at-a.html

Second option could be to try this with JS. Let me know if above does not work!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

pgadhari
Builder

I will try to use the table and see how it looks instead of single viz and revert.

pgadhari
Builder

I have changed the viz to table and used format option to apply colors. I am ok with it. Thanks for your step-1.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...