change background color of single value viz Trellis showing multiple values based on one field value ?

[pgadhari]

I have a query whose one of the field named system is having values BMS or CCTV (total 10 fields are there in table format ) and I am showing the fields for those system in a table format and using the single value viz to show the values in the trellis format. I have applied some CSS to customize trellis. Now, I want to show that if System=BMS then all background color of all trellis fields should be changed to GREEN and if System=CCTV, then it should be changed to "AMBER", as if I have to show the whole row as GREEN or AMBER based on "System" field value. Also some field values are text and some are date along with numeric values, as attached in the image.

My query is same, and I am just passing $token$ to select the Division based on which the value of "System" field changes ( in this case either BMS or CCTV). I tried using status indicator app, but somehow the trellis is not showing values for the fields in that, and hence I used "single value" viz. Attached are the images for your reference :

My query is like below :

.... | sort - Total | sort - Division | search Division=SAS | fields - Full_Name Division | search System=CCTV OR System=BMS

where Division value is a token, when Division=SAS, then it returns System=CCTV and when Division=FM, it returns row System=BMS ?

So, when System value is CCTV, the whole row background color should be GREEN and for System=BMS the background color should be AMBER and that too it should be in "single value" viz using trellis layout ? How can I achieve this ?

![alt text][2] [2]: /storage/temp/290867-query-output-table.png

[niketn · Accepted solution]

Hi @pgadhari please try the following approach:

Step 1 Use one of my old answers to color table row based on expression (SimpleXML with CSS, but you can use JS as well): https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html

Step 2 Then use the other answer to format the table as Single Value as per this answer: https://answers.splunk.com/answers/529004/is-there-a-way-to-display-more-than-20-charts-at-a.html

Second option could be to try this with JS. Let me know if above does not work!

[prettysunshinez]

@niketnilay I tried this..and it worked..
But i created a drilldown that when I click on the host value ,another panel shows..
It is all fine but the dark theme is not working when i add the second panel (to which the first panel drills to).

Ps : Dark theme works well for the other dashboards..

[pgadhari]

@prettysunshinez  - were you able to change the font color ? Actually the answers got read-only., hence could not post the solution.

Actually I used the table_row_highlighting.js from dashboard examples and disabled the whole row highlighting code and used the table_row_highlighting CSS file and changed the font color instead of background color and removed the background-color property and used color property for changing the font color to green, amber and red. Hope this can help  you in case if you want to do it. 

[pgadhari]

@niketnilay - I dont see any option to "Accept" the answer in your comment ?

[niketn]

@pgadhari since I was trying to help you with this and was not sure whether end result will work for you, I had not converted my comment to answer. So that your question remains unanswered and open for other Splunkers to assist with any other alternative if possible. Please accept the answer if your issue is resolved!

Happy Splunking!

[pgadhari]

@niketnilay - - one small requirement, I was able to format the background of the cell based on format expression option, but now I want to show the font color also to the same color as of background, as it will display only background color and not the numeric values ?

Actually, I have to show only cell with background green red amber grey, and don't have to show the values now ? is there a way using CSS or some other way to hide the numeric values of the cell ? Please advise ? I am attaching the screenshot of the table for your reference.

[pgadhari]

@niketnilay - I was able to do the font color same as background. No worries.. Thanks for your support as always :-)...

[prettysunshinez]

Hi,
How the font color was adjusted..Could you pls let me know.
Thanks 🙂

[pgadhari]

Sure. I will share the details.

[niketn]

Sorry was in some session entire day (rather night as per IST).

You could have just hidden the text instead of making background color and font color same.

[pgadhari]

@niketnilay - how can I hide the text ? It would be good to know.

[pgadhari]

below is the url of the image :

https://imgur.com/a/O3wVhot

[pgadhari]

@niketnilay - Sure, I will check both options and revert. Thanks.

[pgadhari]

@niketnilay - I tried using the expression but i think it is not supported in single value panel directly. I saw your step-2 answer, but that is applicable for the "table" viz. I tried putting it in single viz but it says - format node is not allowed Single panel. Below is my XML code.

<row id="d2">
    <panel>
      <title>$div$ - Statistics</title>
      <single>
        <search>
          <query>index=tech sourcetype=transition | table Division System System_Full_Name Physical_Servers Virtual_Servers Workstations Database Storage Chassis SAN_Switch Non_BT_Network_devices Non_BT_AD   | rename System_Full_Name as Full_Name Physical_Servers as Physical Virtual_Servers as Virtual Non_BT_Network_devices as NW_devices Non_BT_AD as AD Date_Takenover as Takenover Database as DBs  | addtotals | fillnull value=0  | sort - Total | sort - Division | search Division=$div$ | fields - Full_Name Division Devices| search System=CCTV OR System=BIS OR System=BHS OR System="TS" OR System=AGL</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="height">66</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>

Actually we have 5 divisions and each divisions has 7 or 4 sub-divisions called as Systems. As explained in my question I am using $div$ token to filter the division name and accordingly in the query I am passing "Systems" name in OR, so based on division selected I get that particular System statistics like physical, virtual, workstations,...and so on, so for each systems (there are 9 stats and its Total that I am showing horizontally using single value panel with trellis layout ). Hope you got it.

And then I am applying CSS to show it in the format as I have attached the image for it in my question. I am attaching the Image for the query output which shows in normal table format and then I select "Single Value" panel to show in above format. So the final result I want it if System=CCTV then all that horizontal row shud be green, which means that the project is complete and if System=BIS OR System=BHS OR System="TS" OR System=AGL, then it should be yellow or red, based on the status of handover.

Actually, step-1 and step-2 is more applicable to table rather than single value - that is what I think, as I cant use format expression in single value, as it is not supported I think.

Hence, please advise is there is any other way of doing it ? Thanks again for your support always. Attaching screenshot of my query for your reference, which I am converting into Single Viz using Trellis.

[niketn]

@pgadhari expression option was for <table> viz to be used as Single Value, not for <single>.The example is a run anywhere sample which you can execute to test.

[pgadhari]

@niketnilay - which example you are referring here ? the one which is specified in the answer of option-2 ?

So, if that is the case, then I cant use colors for the question I have asked ? is that correct ?

[niketn]

They are not options... They are step 1 and step 2

[pgadhari]

@niketnilay - ya ya i understand, but when I try to use step-2 to format my single viz to show the colors, it is not working as format option is available with table and not singel viz , so what I think is - step 2 is not applicable to me, as mine is single viz ? correct ?

[niketn]

Step 1 is for table and step 2 is for table. Step 2 makes table cell appear as single value. There is no single value viz required for this solution.

[pgadhari]

ok got it. Thanks.