Splunk Search

Comparing fields in XML with color

tefa627
Explorer

 

I am trying to compare 2 fields in this xml.  I have a field named avg that I want to compare with the other columns. Below is what I have. I am trying to compare values in "00" with avg and it is not working. Any suggestions?

<format type="color" field="00">
<colorPalette type="expression">if(value &lt;= "avg", "#088D4C",if(value &gt;= 3501 AND value &lt; 6001, "#F5F405" ,"#DE0303"))</colorPalette>
</format>

 

tefa627_2-1605563579360.png

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try "avg" without the double quotes or perhaps use single quotes instead

0 Karma

tefa627
Explorer

I have previously tried both. Neither works.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...