Solved: Visualisation and Color

Cam_G · ‎10-18-2020

Hello,

I have started working on Splunk recently and have encountered a problem, I cannot find how to add a color (either green or red) to a cell in a table depending if it is "<" or ">".

Most post which I have read are either too complicated for me or are for numbers. I simply want to highlight the cell with the sign.

I have 3 rows, the first and last are for number and the middle is the sign that i want to highlight.

Is there a way in the Search page to do what i want ?

Here is how I get the correct sign :

| eval operator_1 = if( Case1 > Case2 ,">", if(isnotnull(Case1) ,"<","") )

Thank you.

to4kawa · ‎10-18-2020

<dashboard>
  <label>Table with color Based on Status</label>
  <row>
    <panel>
      <title>Compliance check</title>
      <html depends="$alwaysHideHTMLCSSPanel$">
        <style>
          #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
      <table id="tableColorFinalRowBasedOnData">
        <search>
          <query>| makeresults count=10
| eval Case1 = random() % 10, Case2= random() % 10
| eval operator = case( Case1 &gt; Case2 ,"&gt;", Case1 &lt; Case2 ,"&lt;",true(), "=" )
| eval color=case(operator="&gt;","HIGH",operator="&lt;","LOW",true(),NULL)
| foreach Case* operator [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color _time
| table Case1 operator Case2</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Case1">
          <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
        </format>
        <format type="color" field="Case2">
          <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
        </format>
        <format type="color" field="operator">
          <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

Row? Not a column?

View solution in original post

to4kawa · ‎10-18-2020

How about my sample dashboard?

Cam_G · ‎10-18-2020

I am not too familiar with XML files that is why I hoped that the solution could be put in the Search area.

As of now I am reading through your reply and trying to understand it.

Thank you for the response.

to4kawa · ‎10-18-2020

<dashboard>
  <label>Table with color Based on Status</label>
  <row>
    <panel>
      <title>Compliance check</title>
      <html depends="$alwaysHideHTMLCSSPanel$">
        <style>
          #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
      <table id="tableColorFinalRowBasedOnData">
        <search>
          <query>| makeresults count=10
| eval Case1 = random() % 10, Case2= random() % 10
| eval operator = case( Case1 &gt; Case2 ,"&gt;", Case1 &lt; Case2 ,"&lt;",true(), "=" )
| eval color=case(operator="&gt;","HIGH",operator="&lt;","LOW",true(),NULL)
| foreach Case* operator [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color _time
| table Case1 operator Case2</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Case1">
          <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
        </format>
        <format type="color" field="Case2">
          <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
        </format>
        <format type="color" field="operator">
          <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

Row? Not a column?

Cam_G · ‎10-18-2020

Thank you,

After much testing, it works fine!

Cam_G · ‎10-18-2020

Yes, my bad, I meant column

Visualisation and Color

visualization

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...