Splunk Search

How to change table cell background color depends on search result to color top 3 value of each column

kuma
New Member

Hello, I would like to change table cell background color of  top 3 value of each column's search result .
For example, top 3 value of column No.1 (50, 29, 25) need to be colored in column No. 1.

kuma_1-1634783298860.png

How can I change those cell background color?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use multivalue fields with the colour you want and then hide the subcell

  <row>
    <panel depends="$stayhidden$">
      <html>
        <style>
          #tableCellColourTopThree table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
    </panel>
    <panel>
      <table id="tableCellColourTopThree">
        <title>Colour Cell by Top 3</title>
        <search>
          <query>| makeresults
| eval data= "10 1 2 10 20 5 2 12 9 33 1 14 5;11 3 2 5 4 11 2 32 5 44 1 88 2;12 5 4 5 3 6 8 12 9 18 3 7 2;5 6 4 8 2 77 5 45 3 12 5 87 9;6 1 2 11 21 5 2 12 9 34 1 14 5;7 3 2 5 4 12 2 33 5 45 1 89 2;8 5 4 5 3 6 8 13 9 19 3 7 2;9 6 4 8 2 78 5 45 3 12 5 86 9;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval Level=mvindex(data,0), one=mvindex(data,1), two=mvindex(data,2), three=mvindex(data,3), four=mvindex(data,4),five=mvindex(data,5)
| sort 0 -one
| streamstats count as rank
| eval one=if(rank&lt;4,mvappend(one,"RED"),one)
| sort 0 -two
| streamstats count as rank
| eval two=if(rank&lt;4,mvappend(two,"RED"),two)
| sort 0 -three
| streamstats count as rank
| eval three=if(rank&lt;4,mvappend(three,"RED"),three)
| sort 0 -four
| streamstats count as rank
| eval four=if(rank&lt;4,mvappend(four,"RED"),four)
| sort 0 -five
| streamstats count as rank
| eval five=if(rank&lt;4,mvappend(five,"RED"),five)
| sort 0 Level
| table Level one two three four five</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color">
          <colorPalette type="expression">case (match(value,"RED"), "#ff0000")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...