Deployment Architecture

Reference to the variable from the query in XML

Bracha
Path Finder

Hi, I have a dashboard in Splunk and I have a question

About the query, I have a line of fields and I have a column. and I want to color specific color if a specific field is true. how to do that. the line in the dashboard of a specific column looks like this:

 

<format type="color" field="nemeOfColumn"> <colorPallete></colorPallete></format>
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
        <format type="color" field="nemeOfColumn">
          <colorPalette type="expression">case(value=="True", "#00ff00")</colorPalette>
        </format>
0 Karma

Bracha
Path Finder

but I have 2 fields, and I want to color the first field according to the value of the second field- if true then color it red. the fields are defined as eval in query. 

thank you

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is a different question (which has been answered many times before). Essentially, you make you field a multivalue field and hide the second value with CSS, but you can sill use the (hidden) value to select the colour by expression.

Solved: Re: Highlight row if unique values exist within dy... - Splunk Community

0 Karma

Bracha
Path Finder

It's not exactly the same question.
My question is how do I color a field according to another field
The query looks like this:

<query>

stats count(Code) as count_by_id

count(eval(like(message, %READ-ERROR -&gt; DP is temporarily down%))) as read_error_count

</query>

 

And I want to color the read_error_count column according to the count_by_id variable
How do I do this in XML?

<option name= "count">13</option>

<option name= "dataOverlayMode">none</option>

<option name= "drilldown">row</option>

<option name= "wrap">true</option>

<format type = "color" field= "read_error_count">

<colorPallete type="list">

<colorPalleteEntry></colorPalleteEntry>

</colorPallete>

</format>

 

Thank you @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct, the question is not identical, but the essence of the question is, that is, how to colour cells based on the value in another cell on the same row, in your case you want the read_error_count colour based on the value of the count_by_id. To do this, as I said earlier, and is shown in more detail in the referenced solution, you use mvappend to add a second value to the read_error_coiunt field based on the value of the count_by_id field

| eval read_error_count=if(count_by_id > 10, mvappend(read_error_count,"RED"), read_error_count)

Then use CSS to hide the second multi-value cell and set the palette to change the colour if "RED" is a value

You can use other strings and colours to your requirements.

0 Karma

Bracha
Path Finder
| stats count(eval(like(message, %READ-ERROR -&gt; DP is temporarily down%))) as read_error_count
|stats count(Code) as count_by_id
|eval color_value = if(read_error_count &gt; count/2 ,0,1)

i want color read_error_count column by color_value result

thanks @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure why you are not adapting my previous suggestion - try something like this

| stats count(eval(like(message, "%READ-ERROR -&gt; DP is temporarily down%"))) as read_error_count count(Code) as count_by_id
|eval read_error_count = if(read_error_count &gt; count_by_id/2 ,mvappend(read_error_count,"RED"), read_error_count)

 

Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...