Splunk Search

How to highlight only the maximum value of a cell in table representation

akarivaratharaj
Communicator

In my dashboard, a table panel which have the percentage of a metric for each month is displayed. Below is the query details:

<Base search>
| stats avg(metric_perc) as Metric over Period by Host

Below are the results of my search query:

Sl.No,  Period,   host1,  host2,  host3
1       Jan        36      52      64
2       Feb        43      69      66
:
:
12      Dec        26      45      58 

I want to highlight only the maximum the values of each host for each period.

[Note: Here host1, host2 and host3 are not column names they are values of the column called Host. As I used the keyword over, I got the above table representation with the combination of 3 fields such as Metric, Period and Host]

Could someone help me in finding how can I highlight or color code only the maximum value of Metric for each host and period.

0 Karma

vnravikumar
Champion

Hi

Check the below logic it will highlight the max value in the specified column in javascript, I hope this logic will help you.

<dashboard script="highlight.js">
  <label>highlight</label>
  <row>
    <panel>
      <table id="rk">
        <search>
          <query>| makeresults 
| eval column1=22,column2=21 
| append 
    [| makeresults 
    | eval column1=12,column2=43] 
| eventstats max(column1) as col1_max, max(column2) as col2_max 
| eval column1= column1."##".col1_max,column2 = column2."##".col2_max</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <fields>_time,column1,column2</fields>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row depends="$hide$">
    <panel>
      <html>
       <style>
           #rk .highlight {
               color: rgb(255, 255, 255) !important; 
               background-color: rgb(220, 78, 65)!important;
           }

       </style>
     </html>
    </panel>
  </row>
</dashboard>

javascript:

require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {

    var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
        canRender: function(cell) {

            return _([ 'column1','column2']).contains(cell.field);
        },
        render: function($td, cell) {
            var value = cell.value.split("##")[0];
            var maxValue = cell.value.split("##")[1];
            if(value == maxValue){
                $td.addClass('highlight');
            }
            $td.text(value).addClass('numeric');
        }
    });
    mvc.Components.get('rk').getVisualization(function(tableView) {
        tableView.table.addCellRenderer(new CustomRangeRenderer());
        tableView.on('rendered', function() {
            tableView.$el.find('td.range-cell').each(function() {
                $(this).parents('tr').addClass(this.className);
            });
        });
        tableView.table.render();
    });
});
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akarivaratharaj,
di you already tried with Data Overlay?
You can find instructions in the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Ciao.
Giuseppe

0 Karma

akarivaratharaj
Communicator

@gcusello Yes I have already tried that. I added the below code to my dashboard source.

<option name="dataOverlayMode">heatmap</option>

This code makes the whole table representation cells with color coded. This is similar to the code of colorPalette where it shows min, mid and max values with color range from low to high.

But I want to show only one value which is the maximum value in a column or row to be highlighted.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...