Splunk Search

How can I define column-color when I do not know in advance what my fields are named?

New Member

I want to query data collected from running containers, indexed into a data set. The particular results will be presented as a table, with each column representing a combination of "datacenter-environment", where the choices are made from a multi-select input. Choices of datacenter can be one or more of up to 10, while each datacenter can have from one to many environments available. For example, I could choose from:

tec1-shared
tec2-shared
tpa3-shared
tec1-usqe1
tpa3-csa1
tea2-core
tec1-core
tea4-core
tpa3-core
tec2-core

And compare, for example, tpa3-core with tec2-core and tec1-core. Right now, I've hard-coded a few combinations into a dashboard, with a sample like:

<format type="color" field="tea2-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="tec1-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="tea4-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>

But this solution does not scale for the many more different combinations. Is there a way to define column-color that could be applied to any combination of selected inputs, without requiring a custom-view?

I've temporarily hacked a solution, by eliminating the field designation in the format, so the colors are applied to ALL columns, but aesthetically, the first column, container should NOT be colored:

<format type="color">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="container">
  <scale type="linear"></scale>
  <colorPalette type="list">[#FFFFFF,#FFFFFF]</colorPalette>
</format>

Unfortunately, since there does not seem to be a way to over-ride the first format, as it applies to ALL columns, this is not the ideal solution

0 Karma

New Member

Changing the scale to be category fixed it!

<format type="color" field="container">
  <scale type="category"></scale>
  <colorPalette type="list">[#FFFFFF,#DCDCDC]</colorPalette>
</format>
0 Karma

Path Finder

Maybe accept above answer for karma? 😉

0 Karma

Path Finder

I think you need to be sure that your data in field 'container' is numeric if you use...

<scale type="linear"></scale>

Maybe try...

<scale type="category"></scale>

...instead for non-numeric data.

0 Karma