Splunk Enterprise

Applying colorPalette expression on all cells in table

Loves-to-Learn Lots

I have created a table that looks as follows:


The colums are variable as they depend on the selected time frame. I want to apply a conditional format on each cell in the table based on the first numeric value in each cell. The cell should be colored red if the numeric value is lower than 400. Applying the following colorPalette expression doesn't seems to work:

<format type="color">
<colorPalette type="expression">if(tonumber(mvindex(split(value," "),0)) &lt; 400,"#FF5733",null)</colorPalette>

 While the following does:

<format type="color">
<colorPalette type="expression">if((substr(value,1,1)="1" OR substr(value,1,1)="2" OR substr(value,1,1)="3" OR substr(value,1,1)="0") AND substr(value,4,1)=" ","#FF5733",if(substr(value,3,1)=" ","#FF5733", null))</colorPalette>

However, the latter expression doesn't color cells with a numeric value of 0. In addition, it looks sloppy and is difficult to understand for my colleagues. Can someone explain why the first expression doesn't work and/or provide a solution?

Thank you.

Labels (1)
0 Karma


This sort of thing comes up quite regularly - essentially, if you create a multivalue field with the second value being an indicator to the colour you want to use, then you can use CSS to hide the second value but the colorPalette option still works. More details here https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu... 

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...