Splunk Enterprise

Applying colorPalette expression on all cells in table

Loves-to-Learn Lots

I have created a table that looks as follows:


The colums are variable as they depend on the selected time frame. I want to apply a conditional format on each cell in the table based on the first numeric value in each cell. The cell should be colored red if the numeric value is lower than 400. Applying the following colorPalette expression doesn't seems to work:

<format type="color">
<colorPalette type="expression">if(tonumber(mvindex(split(value," "),0)) &lt; 400,"#FF5733",null)</colorPalette>

 While the following does:

<format type="color">
<colorPalette type="expression">if((substr(value,1,1)="1" OR substr(value,1,1)="2" OR substr(value,1,1)="3" OR substr(value,1,1)="0") AND substr(value,4,1)=" ","#FF5733",if(substr(value,3,1)=" ","#FF5733", null))</colorPalette>

However, the latter expression doesn't color cells with a numeric value of 0. In addition, it looks sloppy and is difficult to understand for my colleagues. Can someone explain why the first expression doesn't work and/or provide a solution?

Thank you.

Labels (1)
0 Karma


This sort of thing comes up quite regularly - essentially, if you create a multivalue field with the second value being an indicator to the colour you want to use, then you can use CSS to hide the second value but the colorPalette option still works. More details here https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu... 

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...