Splunk Enterprise

Applying colorPalette expression on all cells in table

Loves-to-Learn Lots

I have created a table that looks as follows:


The colums are variable as they depend on the selected time frame. I want to apply a conditional format on each cell in the table based on the first numeric value in each cell. The cell should be colored red if the numeric value is lower than 400. Applying the following colorPalette expression doesn't seems to work:

<format type="color">
<colorPalette type="expression">if(tonumber(mvindex(split(value," "),0)) &lt; 400,"#FF5733",null)</colorPalette>

 While the following does:

<format type="color">
<colorPalette type="expression">if((substr(value,1,1)="1" OR substr(value,1,1)="2" OR substr(value,1,1)="3" OR substr(value,1,1)="0") AND substr(value,4,1)=" ","#FF5733",if(substr(value,3,1)=" ","#FF5733", null))</colorPalette>

However, the latter expression doesn't color cells with a numeric value of 0. In addition, it looks sloppy and is difficult to understand for my colleagues. Can someone explain why the first expression doesn't work and/or provide a solution?

Thank you.

Labels (1)
0 Karma


This sort of thing comes up quite regularly - essentially, if you create a multivalue field with the second value being an indicator to the colour you want to use, then you can use CSS to hide the second value but the colorPalette option still works. More details here https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu... 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...