Splunk Search

How to color code the results in a table column if the values are above a certain number?

shrey12
Explorer

If i have a search that gives me the result as follows, I want to flag a red color in the values of the delta column if the delta is more than say 2. How can i do that?

Power1 &nbsp&nbsp&nbsp Power2 &nbsp&nbsp&nbsp abs(Delta)
12&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp12&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp0
23&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp20&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp3(should be in red color)
44&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp40&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp4(should be in red color)

0 Karma

LukeMurphey
Champion

There are several options here:

Option 1: range map in a table
See the Splunk dashboard examples app for some examples of how to do this. Specifically, you will want to check out “Table Icon Set (Rangemap)”.

Option 2: use a custom cell renderer

See the accepted answer for this question. It uses some custom Javascript but isn't too bad. It will only work on Splunk 6.0+.

Option 3: use custom CSS
See the accepted answer for this question. It also uses some custom Javascript but it is easy to use. This will work on Splunk 5.0 too.

0 Karma

shrey12
Explorer

How can do this with with just sideview utils by adding modules and changing parameters

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...