Splunk Search

How to display an addcoltotals column as a different color so it stands out?

jolver14
New Member

Hello all,

I have a search I'm trying to get just right -- and its 99% there:

disk_usage | dedup host |chart sum(disk_usage) as "Storage Used (TB)" by host | addcoltotals labelfield=host label="Total Storage Used"

Right now, it displays the disk usage from the each individual host and adds them together in a column called Total Storage Used. What I want to do is display the total storage used column as a new color so it stands out.

Is there anyway to do that easily?

Thanks for the help!!!

0 Karma

ppablo
Retired

Hi @jolver14

Just following up with this post, but did @markthompson's answer and comments below help solve your question? If yes, don't forget to resolve this post by clicking "Accept" directly below the answer. Thanks!

0 Karma

markthompson
Builder

Hi Jolver14,
Looking at your question, this would be an ideal place for you to use Custom Cell highlighting.

Although it doesn't set the colour of the whole column, you can configure it to use a rangemap, i.e. if it uses a low amount, show green, medium, show orange, and high show red.

See: Splunk dashboard 6.x dashboard examples or code below;

/* Cell Highlighting */
/* 
#highlight td {
    background-color: #c1ffc3 !important;
}
*/
#highlight td.range-low {
    color: #C0D9D9;
}
#highlight td.range-elevated {
    background-color: #ffc57a !important;
    font-weight: bold;
}
#highlight td.range-severe {
    background-color: #d59392 !important;
    font-weight: bold;
}

JS:

require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
     // Row Coloring Example with custom, client-side range interpretation
    var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
        canRender: function(cell) {
            // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field
            return _(['active_hist_searches', 'active_realtime_searches']).contains(cell.field);
        },
        render: function($td, cell) {
            // Add a class to the cell based on the returned value
            var value = parseFloat(cell.value);
            // Apply interpretation for number of historical searches
            if (cell.field === 'active_hist_searches') {
                if (value > 2) {
                    $td.addClass('range-cell').addClass('range-severe');
                }
                else if (value > 1) {
                    $td.addClass('range-cell').addClass('range-elevated');
                }
                else if (value > 0) {
                    $td.addClass('range-cell').addClass('range-low');
                }
            }
            // Apply interpretation for number of realtime searches
            if (cell.field === 'active_realtime_searches') {
                if (value > 1) {
                    $td.addClass('range-cell').addClass('range-severe');
                }
            }
            // Update the cell content
            $td.text(value.toFixed(2)).addClass('numeric');
        }
    });
    mvc.Components.get('highlight').getVisualization(function(tableView) {
        // Add custom cell renderer
        tableView.table.addCellRenderer(new CustomRangeRenderer());
        // tableView.on('rendered', function() {
            // Apply class of the cells to the parent row in order to color the whole row
           // tableView.$el.find('td.range-cell').each(function() {
           //     $(this).addClass(this.className);
           // });
        //});
        // Force the table to re-render
        tableView.table.render();
    });
});

This I believe might suit you more, but if you wish to just change the colour of the column I believe you must use HTML/CSS combination for your table, please post the source code for your table and I'll see If i can come up with something.

0 Karma

markthompson
Builder

Hi @jolver14

You could try adding custom CSS to your dashboard and using the following;

.tablewithcolour tr td:nth-child(COLUMN NUMBER)
{
background-color: #WHATEVER;
}

And apply that .tablewithcolour class to your table in your dashboard source.

That should work.

0 Karma

jolver14
New Member

Here's the XML for the Dashboard. If I wanted to insert the CSS, where would I do that?

 <label>Total Storage Used (TB)</label>
  <description>Displays the total storage used across all Solaris servers in TB.</description>
  <row>
    <panel>
      <chart>
        <title>Total Storage Used (TB)</title>
        <searchString>disk_usage | dedup host |chart sum(disk_usage) as "Storage Used (TB)" by host | addcoltotals labelfield=host label="Total Storage Used"</searchString>
        <earliestTime/>
        <latestTime/>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
     </panel>
  </row>
</dashboard>
0 Karma

markthompson
Builder

@jolver14 - if you want to add custom CSS, you can create a HTML panel with

0 Karma

jolver14
New Member

Mark,

It looks like the response might be cut off. Would you mind explaining how to implement what you suggest again?

Thanks for your patience and assistance.

0 Karma

markthompson
Builder

No problem Jolver.

you can use < style > tags inside a HTML panel if you wish to add CSS inline.

0 Karma

jolver14
New Member

Mark,

Sorry for the delay in responding. Honestly, I'd really like just to change the column color, as there isn't really a range we're looking for, we just want it to be SUPER easy to see how much is being used.

Below is the XML for the table.

<results preview="0">
<meta>
<fieldOrder>
<field>host</field>
<field>Storage Used (TB)</field>
</fieldOrder>
</meta>
<result offset="0">
<field k="host">
<value>
<text>ServName</text>
</value>
</field>
<field k="Storage Used (TB)">
<value>
<text>2.9876</text>
</value>
</field>
</result>
<result offset="1">
<field k="host">
<value>
<text>ServName</text>
</value>
</field>
<field k="Storage Used (TB)">
<value>
<text>3.555</text>
</value>
</field>
</result>
<result offset="2">
<field k="host">
<value>
<text>ServName</text>
</value>
</field>
</result>
<result offset="3">
<field k="host">
<value>
<text>Total Storage Used</text>
</value>
</field>
<field k="Storage Used (TB)">
<value>
<text>4.1654</text>
</value>
</field>
</result>
</results>

Thanks for any assistance you can offer!

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...