Splunk Search

Color in a Table based on a row of numbers

mfudali
Explorer

Hi,

 

I have a Table created by:

 

eval Actor=actor |

eval "Total Time (max/avg/p50/p99)"=maxT + ", " + avgT + ", " + p50T + ", " + p99T |
eval "Thread Execution Time (max/avg/p50/p99)"=maxE + ", " + avgE + ", " + p50E + ", " + p99E |
eval "Time On Queue (max/avg/p50/p99)"=maxOnQ + ", " + avgOnQ + ", " + p50OnQ + ", " + p99OnQ |
eval "Queue Depth (max/avg/p50/p99)"=maxqUsed + ", " + avgqUsed + ", " + p50qUsed + ", " + p99qUsed |
eval "TPS (max/avg/p50/p99)"=maxTPS + ", " + avgTPS + ", " + p50TPS + ", " + p99TPS |

<!--- create a table -->
table Actor, "Total Time (max/avg/p50/p99)", "Thread Execution Time (max/avg/p50/p99)", "Time On Queue (max/avg/p50/p99)" , "Queue Depth (max/avg/p50/p99)", "TPS (max/avg/p50/p99)" |

 

Which looks like:

mfudali_0-1632925461692.png

 

I wanted to change the color of the entire cell based on the max value. Say if max value is greater than 10000, color the cell red, else some other color.

 

I've tried following: https://community.splunk.com/t5/Dashboards-Visualizations/change-the-color-of-row-based-on-cell-valu...

 

But I can't seem to get it to work with numbers. Any help is appreciated thanks!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The answer you are referring to uses a case statement to set the value of color - you could change this to a simple if statement, for example, comparing maxT with 10000. You may wish to consider having different color fields e.g. colorT, colorE, etc. if you have different thresholds for your colours.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...