Splunk Search

Color in a Table based on a row of numbers

mfudali
Explorer

Hi,

 

I have a Table created by:

 

eval Actor=actor |

eval "Total Time (max/avg/p50/p99)"=maxT + ", " + avgT + ", " + p50T + ", " + p99T |
eval "Thread Execution Time (max/avg/p50/p99)"=maxE + ", " + avgE + ", " + p50E + ", " + p99E |
eval "Time On Queue (max/avg/p50/p99)"=maxOnQ + ", " + avgOnQ + ", " + p50OnQ + ", " + p99OnQ |
eval "Queue Depth (max/avg/p50/p99)"=maxqUsed + ", " + avgqUsed + ", " + p50qUsed + ", " + p99qUsed |
eval "TPS (max/avg/p50/p99)"=maxTPS + ", " + avgTPS + ", " + p50TPS + ", " + p99TPS |

<!--- create a table -->
table Actor, "Total Time (max/avg/p50/p99)", "Thread Execution Time (max/avg/p50/p99)", "Time On Queue (max/avg/p50/p99)" , "Queue Depth (max/avg/p50/p99)", "TPS (max/avg/p50/p99)" |

 

Which looks like:

mfudali_0-1632925461692.png

 

I wanted to change the color of the entire cell based on the max value. Say if max value is greater than 10000, color the cell red, else some other color.

 

I've tried following: https://community.splunk.com/t5/Dashboards-Visualizations/change-the-color-of-row-based-on-cell-valu...

 

But I can't seem to get it to work with numbers. Any help is appreciated thanks!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The answer you are referring to uses a case statement to set the value of color - you could change this to a simple if statement, for example, comparing maxT with 10000. You may wish to consider having different color fields e.g. colorT, colorE, etc. if you have different thresholds for your colours.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...