Splunk Search

Comparing fields in XML with color

tefa627
Explorer

 

I am trying to compare 2 fields in this xml.  I have a field named avg that I want to compare with the other columns. Below is what I have. I am trying to compare values in "00" with avg and it is not working. Any suggestions?

<format type="color" field="00">
<colorPalette type="expression">if(value &lt;= "avg", "#088D4C",if(value &gt;= 3501 AND value &lt; 6001, "#F5F405" ,"#DE0303"))</colorPalette>
</format>

 

tefa627_2-1605563579360.png

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try "avg" without the double quotes or perhaps use single quotes instead

0 Karma

tefa627
Explorer

I have previously tried both. Neither works.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...