Splunk Search

How can make every 2 columns of table as same colour?

jenniferhao
Explorer

I have a big table which is not easy to group on visualizations. Can I make each 2 columns as same color group so that can see them together  immediately. For example:

jenniferhao_0-1616783879400.png

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Give your table an id and add a hidden style panel

    <panel depends="$stayhidden$">
      <title>Only SimpleXML no JS required</title>
      <html>
        <style>
          #tableColumnPairs th:nth-child(4n+0),
          #tableColumnPairs td:nth-child(4n+0),
          #tableColumnPairs th:nth-child(4n+1),
          #tableColumnPairs td:nth-child(4n+1){
            background: #cccc00 !important;
          }
          #tableColumnPairs th:nth-child(4n+2),
          #tableColumnPairs td:nth-child(4n+2),
          #tableColumnPairs th:nth-child(4n+3),
          #tableColumnPairs td:nth-child(4n+3){
            background: #cc0000 !important;
          }
        </style>
      </html>
    </panel>
    <panel>
      <table id="tableColumnPairs ">
0 Karma

jenniferhao
Explorer

Sorry for reply late. I did the testing but it seems not working. 
<dashboard>
<row>
<panel depends="$stayhidden$">
<html>
<style>
#tableColumnPairs th:nth-child(4n+0),
#tableColumnPairs td:nth-child(4n+0),
#tableColumnPairs th:nth-child(4n+1),
#tableColumnPairs td:nth-child(4n+1){
background: #cc0000 !important;
}
#tableColumnPairs th:nth-child(4n+2),
#tableColumnPairs td:nth-child(4n+2),
#tableColumnPairs th:nth-child(4n+3),
#tableColumnPairs td:nth-child(4n+3){
background: #cc0000 !important;
}
</style>
</html>
</panel>
<panel>
<table id="tableColumnPairs">
<title>Table with Value and Color Combined </title>
<search>
<query>| makeresults
| eval data= "C1 1 2 10 20 5 2 12 9 33 1 14 5;C2 3 2 5 4 11 2 32 5 44 1 88 2;C3 5 4 5 3 6 8 12 9 18 3 7 2;C4 6 4 8 2 77 5 45 3 12 5 87 9;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4),pre3=mvindex(data,5), post3=mvindex(data,6),pre4=mvindex(data,7), post4=mvindex(data,8),pre5=mvindex(data,9), post5=mvindex(data,10),pre6=mvindex(data,11), post6=mvindex(data,12)
| fields - _time data
|table pre1 post1 pre2 post2 pre3 post3 pre4 post4 pre5 post5 pre6 post6
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard><dashboard>
<row>
<panel depends="$stayhidden$">
<html>
<style>
#tableColumnPairs th:nth-child(4n+0),
#tableColumnPairs td:nth-child(4n+0),
#tableColumnPairs th:nth-child(4n+1),
#tableColumnPairs td:nth-child(4n+1){
background: #cc0000 !important;
}
#tableColumnPairs th:nth-child(4n+2),
#tableColumnPairs td:nth-child(4n+2),
#tableColumnPairs th:nth-child(4n+3),
#tableColumnPairs td:nth-child(4n+3){
background: #cc0000 !important;
}
</style>
</html>
</panel>
<panel>
<table id="tableColumnPairs">
<title>Table with Value and Color Combined </title>
<search>
<query>| makeresults
| eval data= "C1 1 2 10 20 5 2 12 9 33 1 14 5;C2 3 2 5 4 11 2 32 5 44 1 88 2;C3 5 4 5 3 6 8 12 9 18 3 7 2;C4 6 4 8 2 77 5 45 3 12 5 87 9;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4),pre3=mvindex(data,5), post3=mvindex(data,6),pre4=mvindex(data,7), post4=mvindex(data,8),pre5=mvindex(data,9), post5=mvindex(data,10),pre6=mvindex(data,11), post6=mvindex(data,12)
| fields - _time data
|table pre1 post1 pre2 post2 pre3 post3 pre4 post4 pre5 post5 pre6 post6
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>

jenniferhao_0-1617811055714.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Apart from using the same colour for both sets of pairs of columns, I can't see anything wrong, indeed, it works for me

ITWhisperer_0-1617812742925.png

 

0 Karma

jenniferhao
Explorer

I tested it on the last Splunk(8.1.3). It works well. But our PROD version is Splunk Enterprise Version:7.3.3Build:7af3758d0d5e. But it doesn't work at all. Anyway thanks for help.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I don't have that build available (at the moment) but my guess would be that the HTML is constructed differently, perhaps the id is not passed in the same way or the table is built differently. If you can inspect the page, perhaps we can work out a fix or you upgrade production 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...