Splunk Search

Comparing fields in XML with color

tefa627
Explorer

 

I am trying to compare 2 fields in this xml.  I have a field named avg that I want to compare with the other columns. Below is what I have. I am trying to compare values in "00" with avg and it is not working. Any suggestions?

<format type="color" field="00">
<colorPalette type="expression">if(value &lt;= "avg", "#088D4C",if(value &gt;= 3501 AND value &lt; 6001, "#F5F405" ,"#DE0303"))</colorPalette>
</format>

 

tefa627_2-1605563579360.png

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try "avg" without the double quotes or perhaps use single quotes instead

0 Karma

tefa627
Explorer

I have previously tried both. Neither works.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...