Splunk Search

Change Column Color - Splunk Dashboard

isac_santana
Explorer

Good afternoon,

I need help changing the colors of two columns in my <panel>.

I need to change the colors of the "Values - Requested" and "Values - Retrieved" columns.

When the values in these two columns are the same, color the cell background green. And when they are different, color it red.

Does anyone know how to do this?

isac_santana_0-1755028387598.png

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You have to a bit of a trick to do this, because you can't set a colour in one cell with a formula to compare the value of another cell, you can do it this way.

First you turn each of those values into a multi value cell, where the second value is the relationship with the other cell

``` Set a colour if they are the same/different ```
| eval colour=if('Valores - Solicitados'='Valores - Recuperados', "#00ff00", 
"#ff0000")
``` Create each field as a multivalue field with the second value as colour ```
| eval 'Valores - Solicitados'=mvappend('Valores - Solicitados', colour)
| eval 'Valores - Recuperados'=mvappend('Valores - Recuperados', colour)
| fields - colour

 

Then you should use CSS to limit the display of those fields to only display the single value, add a hidden html panel with the CSS to hide the multivalue fields 2nd value - note here "coloured_cell" is the id of your table element.

<html depends="$hidden$">
  <style>
    #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
       display: none;
     }
  </style>
</html>

 

You should set the id of your table as below

<table id="coloured_cell">

and then finally use the format specifier in the XML to set the colour

<format type="color" field="Valores - Solicitados">
  <colorPalette type="expression">mvindex(value, 1)</colorPalette>
</format>
<format type="color" field="Valores - Recuperados">
  <colorPalette type="expression">mvindex(value, 1)</colorPalette>
</format>

Here's a full example dashboard

<form version="1.1">
  <label>Demo1</label>
  <row>
    <panel>
      <html depends="$hidden$">
        <style>
          #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
      <table id="coloured_cell">
        <title>Colouring a table cell based on it's relative comparison to another cell</title>
        <search>
          <query>| makeresults count=10
| fields - _time
| eval Result="Result"
| eval "Valores - Solicitados"=random() % 8, "Valores - Recuperados"=random() % 8
``` Set a colour if they are the same/different ```
| eval colour=if('Valores - Solicitados'='Valores - Recuperados', "#00ff00", "#ff0000")
``` Create each field as a multivalue field with the second value as colour ```
| eval "Valores - Solicitados"=mvappend('Valores - Solicitados', colour)
| eval "Valores - Recuperados"=mvappend('Valores - Recuperados', colour)
| fields - colour
| table Result "Valores - Solicitados" "Valores - Recuperados"

          </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="Valores - Solicitados">
          <colorPalette type="expression">mvindex(value, 1)</colorPalette>
        </format>
        <format type="color" field="Valores - Recuperados">
          <colorPalette type="expression">mvindex(value, 1)</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You have to a bit of a trick to do this, because you can't set a colour in one cell with a formula to compare the value of another cell, you can do it this way.

First you turn each of those values into a multi value cell, where the second value is the relationship with the other cell

``` Set a colour if they are the same/different ```
| eval colour=if('Valores - Solicitados'='Valores - Recuperados', "#00ff00", 
"#ff0000")
``` Create each field as a multivalue field with the second value as colour ```
| eval 'Valores - Solicitados'=mvappend('Valores - Solicitados', colour)
| eval 'Valores - Recuperados'=mvappend('Valores - Recuperados', colour)
| fields - colour

 

Then you should use CSS to limit the display of those fields to only display the single value, add a hidden html panel with the CSS to hide the multivalue fields 2nd value - note here "coloured_cell" is the id of your table element.

<html depends="$hidden$">
  <style>
    #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
       display: none;
     }
  </style>
</html>

 

You should set the id of your table as below

<table id="coloured_cell">

and then finally use the format specifier in the XML to set the colour

<format type="color" field="Valores - Solicitados">
  <colorPalette type="expression">mvindex(value, 1)</colorPalette>
</format>
<format type="color" field="Valores - Recuperados">
  <colorPalette type="expression">mvindex(value, 1)</colorPalette>
</format>

Here's a full example dashboard

<form version="1.1">
  <label>Demo1</label>
  <row>
    <panel>
      <html depends="$hidden$">
        <style>
          #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
      <table id="coloured_cell">
        <title>Colouring a table cell based on it's relative comparison to another cell</title>
        <search>
          <query>| makeresults count=10
| fields - _time
| eval Result="Result"
| eval "Valores - Solicitados"=random() % 8, "Valores - Recuperados"=random() % 8
``` Set a colour if they are the same/different ```
| eval colour=if('Valores - Solicitados'='Valores - Recuperados', "#00ff00", "#ff0000")
``` Create each field as a multivalue field with the second value as colour ```
| eval "Valores - Solicitados"=mvappend('Valores - Solicitados', colour)
| eval "Valores - Recuperados"=mvappend('Valores - Recuperados', colour)
| fields - colour
| table Result "Valores - Solicitados" "Valores - Recuperados"

          </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="Valores - Solicitados">
          <colorPalette type="expression">mvindex(value, 1)</colorPalette>
        </format>
        <format type="color" field="Valores - Recuperados">
          <colorPalette type="expression">mvindex(value, 1)</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>
0 Karma

isac_santana
Explorer

IF( "Valores - Solicitados" == "Valores - Recuperados" , Color Verde, Color Red)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...