Hello,
I have started working on Splunk recently and have encountered a problem, I cannot find how to add a color (either green or red) to a cell in a table depending if it is "<" or ">".
Most post which I have read are either too complicated for me or are for numbers. I simply want to highlight the cell with the sign.
I have 3 rows, the first and last are for number and the middle is the sign that i want to highlight.
Is there a way in the Search page to do what i want ?
Here is how I get the correct sign :
| eval operator_1 = if( Case1 > Case2 ,">", if(isnotnull(Case1) ,"<","") )
Thank you.
<dashboard>
<label>Table with color Based on Status</label>
<row>
<panel>
<title>Compliance check</title>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>| makeresults count=10
| eval Case1 = random() % 10, Case2= random() % 10
| eval operator = case( Case1 > Case2 ,">", Case1 < Case2 ,"<",true(), "=" )
| eval color=case(operator=">","HIGH",operator="<","LOW",true(),NULL)
| foreach Case* operator [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color _time
| table Case1 operator Case2</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="refresh.display">progressbar</option>
<format type="color" field="Case1">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="Case2">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="operator">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Row? Not a column?
How about my sample dashboard?
I am not too familiar with XML files that is why I hoped that the solution could be put in the Search area.
As of now I am reading through your reply and trying to understand it.
Thank you for the response.
<dashboard>
<label>Table with color Based on Status</label>
<row>
<panel>
<title>Compliance check</title>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>| makeresults count=10
| eval Case1 = random() % 10, Case2= random() % 10
| eval operator = case( Case1 > Case2 ,">", Case1 < Case2 ,"<",true(), "=" )
| eval color=case(operator=">","HIGH",operator="<","LOW",true(),NULL)
| foreach Case* operator [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color _time
| table Case1 operator Case2</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="refresh.display">progressbar</option>
<format type="color" field="Case1">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="Case2">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="operator">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Row? Not a column?
Thank you,
After much testing, it works fine!
Yes, my bad, I meant column