Splunk Search
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to change color for entire row?

priya1926
Path Finder
‎03-08-2022 04:09 AM

my query is 

<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<table>
<search>
<query>index=*** source=service Name IN (*abc* *def* *ghi* *jkl* *mno*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(Status="Stopped","HIGH",Status="Running","LOW")
| foreach Name Status State [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

 

For the below result where i have "State" as "Stopped" , the entire row should be in Red Color including corresponding Status and Name.

Name Status State
abc OK Running
def OK Running
hij OK Stopped
klm OK Running
nop OK Running
Labels (2)
Labels
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

SanjayReddy
SplunkTrust
SplunkTrust
‎03-08-2022 05:50 AM

Hi @priya1926 

you missed to add table id  and properties of tableColorFinalRowBasedOnData , please find updated code

<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

 

 

View solution in original post

Reply
Solved! Jump to solution

SanjayReddy
SplunkTrust
SplunkTrust
‎03-08-2022 04:41 AM

Hi @priya1926 

there is already one post for same requement , which might helps you 

can you please refer to it 

https://community.splunk.com/t5/Dashboards-Visualizations/change-the-color-of-row-based-on-cell-valu... 

Reply
Solved! Jump to solution

priya1926
Path Finder
‎03-08-2022 05:10 AM

I tired mvindex to get the colour. But i am getting the #code in each field value in the table.

<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<table>
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

0 Karma
Reply
Solved! Jump to solution
Solution

SanjayReddy
SplunkTrust
SplunkTrust
‎03-08-2022 05:50 AM

Hi @priya1926 

you missed to add table id  and properties of tableColorFinalRowBasedOnData , please find updated code

<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

 

 

Reply
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...
li.common.scroll-to.top