Splunk Enterprise

How to add colour feature in dashboard which the value is in the time format

Srubhi
Path Finder

I did not received the expected result on the below query,
could anyone please check.

https://community.splunk.com/t5/Splunk-Enterprise/How-to-add-colour-feature-in-dashboard/m-p/603148#...


In the below dashboard table, I need to set colour condition of 2 columns that is is expected difference and sla_difference.
if expected_difference Is negative it should show in red colour if it is positive it should show in green colour.
same as for sla_difference if it is negative it should be orange if it is positive it should show in green.

Srubhi_0-1656421015848.png

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

Srubhi
Path Finder

thank you @preotesoiu it worked for me!!

View solution in original post

0 Karma

Srubhi
Path Finder

thank you @preotesoiu it worked for me!!

0 Karma

preotesoiu
Path Finder

you have to edit the xml, see below as example, adjust the colours as need it

<dashboard theme="dark">
<label>test collor pallete</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval result1="-100", result2 = "23"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<format type="color" field="result1">
<colorPalette type="expression">if(like(value,"%-%"),"#65A637", "#FF0000")</colorPalette>
</format>
<format type="color" field="result2">
<colorPalette type="expression">if(like(value,"%-%"),"#65A637", "#FF0000")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...