Splunk Search

How can I define column-color when I do not know in advance what my fields are named?

Jaff
New Member

I want to query data collected from running containers, indexed into a data set. The particular results will be presented as a table, with each column representing a combination of "datacenter-environment", where the choices are made from a multi-select input. Choices of datacenter can be one or more of up to 10, while each datacenter can have from one to many environments available. For example, I could choose from:

tec1-shared
tec2-shared
tpa3-shared
tec1-usqe1
tpa3-csa1
tea2-core
tec1-core
tea4-core
tpa3-core
tec2-core

And compare, for example, tpa3-core with tec2-core and tec1-core. Right now, I've hard-coded a few combinations into a dashboard, with a sample like:

<format type="color" field="tea2-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="tec1-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="tea4-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>

But this solution does not scale for the many more different combinations. Is there a way to define column-color that could be applied to any combination of selected inputs, without requiring a custom-view?

I've temporarily hacked a solution, by eliminating the field designation in the format, so the colors are applied to ALL columns, but aesthetically, the first column, container should NOT be colored:

<format type="color">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="container">
  <scale type="linear"></scale>
  <colorPalette type="list">[#FFFFFF,#FFFFFF]</colorPalette>
</format>

Unfortunately, since there does not seem to be a way to over-ride the first format, as it applies to ALL columns, this is not the ideal solution

0 Karma

Jaff
New Member

Changing the scale to be category fixed it!

<format type="color" field="container">
  <scale type="category"></scale>
  <colorPalette type="list">[#FFFFFF,#DCDCDC]</colorPalette>
</format>
0 Karma

kulick
Path Finder

Maybe accept above answer for karma? 😉

0 Karma

kulick
Path Finder

I think you need to be sure that your data in field 'container' is numeric if you use...

<scale type="linear"></scale>

Maybe try...

<scale type="category"></scale>

...instead for non-numeric data.

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...