Splunk Search

Create a colorPalette that includes NOT LIKE case for fields that are blank

noob4now
New Member

Working to create a colored chart that when an alarm is acknowledged, the system generates a new message with the user's ID, otherwise it is blank. The color change is expected to occur when the field is not ""

<format type="color" field="AckID">
    <colorPalette type="expression">case(not like(value,""),"33FF33")</colorPalette>

This works as a regular like expression, but unsure how to get it to work for something other than a blank field.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...