Splunk Search

How to color code the results in a table column if the values are above a certain number?

Explorer

If i have a search that gives me the result as follows, I want to flag a red color in the values of the delta column if the delta is more than say 2. How can i do that?

Power1 &nbsp&nbsp&nbsp Power2 &nbsp&nbsp&nbsp abs(Delta)
12&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp12&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp0
23&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp20&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp3(should be in red color)
44&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp40&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp4(should be in red color)

0 Karma

Champion

There are several options here:

Option 1: range map in a table
See the Splunk dashboard examples app for some examples of how to do this. Specifically, you will want to check out “Table Icon Set (Rangemap)”.

Option 2: use a custom cell renderer

See the accepted answer for this question. It uses some custom Javascript but isn't too bad. It will only work on Splunk 6.0+.

Option 3: use custom CSS
See the accepted answer for this question. It also uses some custom Javascript but it is easy to use. This will work on Splunk 5.0 too.

0 Karma

Explorer

How can do this with with just sideview utils by adding modules and changing parameters

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!