colorpallette expression not matching field value

[thaghost99]

hi, need some help, i have this format type but it seems the word 'up' is not matching for whatever reason.

there is no spaces or anything in the field value. 

the field value is extracted using 'rex'.

i have this working in other fields, but this one got me stuck. 

any help will be appreciated. 

<format type="color" field="state">
<colorPalette type="expression">if (value == "up","#Green", "#Yellow")</colorPalette>
</format>

[bowesmana · Accepted solution]

I don't believe you can use colour names, such as Green and Yellow, you have to use hex codes or RGB, see here

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML#Color_palette_types_and...

in your case it's interesting that you have yellow, as I would expect black if it does not understand colour names.

Have you tried

<colorPalette type="expression">if(value == "up","#00FF00", "#FFFF00")</colorPalette>

[Richfez]

What's the actual regex you are using to capture it?
And if you are sure you are using the right syntax because you copy pasted it from some working one - you could try to add | eval state = "up" as the last command in the search to force it to be "up" and see if that works.  If it doesn't, then I'd say there's something else wrong with that syntax.