Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to change color for entire row?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
my query is
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<table>
<search>
<query>index=*** source=service Name IN (*abc* *def* *ghi* *jkl* *mno*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(Status="Stopped","HIGH",Status="Running","LOW")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
For the below result where i have "State" as "Stopped" , the entire row should be in Red Color including corresponding Status and Name.
| Name | Status | State |
| abc | OK | Running |
| def | OK | Running |
| hij | OK | Stopped |
| klm | OK | Running |
| nop | OK | Running |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @priya1926
you missed to add table id and properties of tableColorFinalRowBasedOnData , please find updated code
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @priya1926
there is already one post for same requement , which might helps you
can you please refer to it
https://community.splunk.com/t5/Dashboards-Visualizations/change-the-color-of-row-based-on-cell-valu...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tired mvindex to get the colour. But i am getting the #code in each field value in the table.
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<table>
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @priya1926
you missed to add table id and properties of tableColorFinalRowBasedOnData , please find updated code
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
Splunk Observability for AI
🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler
