Solved: Re: Change Header colors in a Table when the resul...

sdhawanx · ‎12-13-2020

Hi Splunkers,

I have a table that displays a value and corresponding to that the number of time that value has occurred. By default the table header is colored as Blue. I want to change the table header to Grey if the values returned are zero, or the search returns no results.

I do not have access to .js. i can only make changes using simple XML. i have been trying to find a solution to this for quite some time now but i have had no success at all. Any leads would be wonderful.

This is how my table looks right now when there is no data

@niketn if possible could you help me out with this. I hear you are a legend around here.

renjith_nair · ‎12-14-2020

Try this run anywhere example in simple XML

<form>
  <label>Table Header Color</label>
  <fieldset submitButton="false">
    <input type="radio" token="sourcetype">
      <label>Sourcetype</label>
      <choice value="splunkd">Splunk</choice>
      <choice value="invalid">Invalid</choice>
      <default>splunkd</default>
      <initialValue>splunkd</initialValue>
    </input>
  </fieldset>
  <row>
    <panel depends="$alwaysHideCSSStyle$">
      <html>
        <style>
            .table th {
               background-color: $th_color$ !important;
            }

        </style>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.count$ &gt; 0">
              <set token="th_color">green</set>
            </condition>
            <condition>
              <set token="th_color">red</set>
            </condition>
          </done>
          <query>index=_internal sourcetype="$sourcetype$"|stats count by sourcetype
| appendpipe [stats count | where count=0]</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Use the radio button to control the count and test. You may change the colors and condition according to your requirement

Happy Splunking!

View solution in original post

renjith_nair · ‎12-14-2020

Try this run anywhere example in simple XML

<form>
  <label>Table Header Color</label>
  <fieldset submitButton="false">
    <input type="radio" token="sourcetype">
      <label>Sourcetype</label>
      <choice value="splunkd">Splunk</choice>
      <choice value="invalid">Invalid</choice>
      <default>splunkd</default>
      <initialValue>splunkd</initialValue>
    </input>
  </fieldset>
  <row>
    <panel depends="$alwaysHideCSSStyle$">
      <html>
        <style>
            .table th {
               background-color: $th_color$ !important;
            }

        </style>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.count$ &gt; 0">
              <set token="th_color">green</set>
            </condition>
            <condition>
              <set token="th_color">red</set>
            </condition>
          </done>
          <query>index=_internal sourcetype="$sourcetype$"|stats count by sourcetype
| appendpipe [stats count | where count=0]</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Use the radio button to control the count and test. You may change the colors and condition according to your requirement

Happy Splunking!

sdhawanx · ‎12-23-2020

thanks for the help. it worked out like a charm

sdhawanx · ‎12-15-2020

Thanks for the reply. i will test this out and let you know if this works for me. Thanks a ton.

Change Header colors in a Table when the result is null or empty only using simple xml.

chart

count

table

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor

Introducing the 2024 SplunkTrust!