Splunk Search

Change Header colors in a Table when the result is null or empty only using simple xml.

sdhawanx
Path Finder

Hi Splunkers,

I have a table that displays a value and corresponding to that the number of time that value has occurred. By default the table header is colored as Blue. I want to change the table header to Grey if the values returned are zero, or the search returns no results. 

I do not have access to .js. i can only make changes using simple XML. i have been trying to find a solution to this for quite some time now but i have had no success at all. Any leads would be wonderful.

This is how my table looks right now when there is no data

sdhawanx_0-1607930998909.png

 

@niketnilay  if possible could you help me out with this. I hear you are a legend around here.

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try this run anywhere example in simple XML

<form>
  <label>Table Header Color</label>
  <fieldset submitButton="false">
    <input type="radio" token="sourcetype">
      <label>Sourcetype</label>
      <choice value="splunkd">Splunk</choice>
      <choice value="invalid">Invalid</choice>
      <default>splunkd</default>
      <initialValue>splunkd</initialValue>
    </input>
  </fieldset>
  <row>
    <panel depends="$alwaysHideCSSStyle$">
      <html>
        <style>
            .table th {
               background-color: $th_color$ !important;
            }

        </style>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.count$ &gt; 0">
              <set token="th_color">green</set>
            </condition>
            <condition>
              <set token="th_color">red</set>
            </condition>
          </done>
          <query>index=_internal sourcetype="$sourcetype$"|stats count by sourcetype
| appendpipe [stats count | where count=0]</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

Use the radio button to control the count and test. You may change the colors and condition according to your requirement

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try this run anywhere example in simple XML

<form>
  <label>Table Header Color</label>
  <fieldset submitButton="false">
    <input type="radio" token="sourcetype">
      <label>Sourcetype</label>
      <choice value="splunkd">Splunk</choice>
      <choice value="invalid">Invalid</choice>
      <default>splunkd</default>
      <initialValue>splunkd</initialValue>
    </input>
  </fieldset>
  <row>
    <panel depends="$alwaysHideCSSStyle$">
      <html>
        <style>
            .table th {
               background-color: $th_color$ !important;
            }

        </style>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.count$ &gt; 0">
              <set token="th_color">green</set>
            </condition>
            <condition>
              <set token="th_color">red</set>
            </condition>
          </done>
          <query>index=_internal sourcetype="$sourcetype$"|stats count by sourcetype
| appendpipe [stats count | where count=0]</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

Use the radio button to control the count and test. You may change the colors and condition according to your requirement

View solution in original post

0 Karma

sdhawanx
Path Finder

thanks for the help. it worked out like a charm

 

sdhawanx
Path Finder

Thanks for the reply. i will test this out and let you know if this works for me. Thanks a ton.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!