Splunk Enterprise

How to add colour feature in dashboard which the value is in the time format


I did not received the expected result on the below query,
could anyone please check.


In the below dashboard table, I need to set colour condition of 2 columns that is is expected difference and sla_difference.
if expected_difference Is negative it should show in red colour if it is positive it should show in green colour.
same as for sla_difference if it is negative it should be orange if it is positive it should show in green.




Labels (1)
Tags (1)
0 Karma
1 Solution


thank you @preotesoiu it worked for me!!

View solution in original post

0 Karma


thank you @preotesoiu it worked for me!!

0 Karma

Path Finder

you have to edit the xml, see below as example, adjust the colours as need it

<dashboard theme="dark">
<label>test collor pallete</label>
<query>| makeresults
| eval result1="-100", result2 = "23"</query>
<option name="drilldown">none</option>
<format type="color" field="result1">
<colorPalette type="expression">if(like(value,"%-%"),"#65A637", "#FF0000")</colorPalette>
<format type="color" field="result2">
<colorPalette type="expression">if(like(value,"%-%"),"#65A637", "#FF0000")</colorPalette>

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...