Splunk Search

How to make the column one color?

robertlynch2020
Motivator

Hi

I have a table with TEXT, i have 3 columns.

| table no1 no2 email

I want the column email to be gray, I cant seem to do this with the current options, they are based on numbers, or am i missing something.

How can i set a wild character to do this? As start does not work

  ![<format type="color" field="email_address">
          <colorPalette type="map">{"*":#708794,"Unknown":#708794}</colorPalette>
        </format>][1]

Rob

0 Karma
1 Solution

renjith_nair
Legend

@robertlynch2020 ,

If you want only one color, just use list and add only grey to the list.

        <format type="color" field="email_address">
          <colorPalette type="list">[#708794] </colorPalette>
        </format>   
Happy Splunking!

View solution in original post

renjith_nair
Legend

@robertlynch2020 ,

If you want only one color, just use list and add only grey to the list.

        <format type="color" field="email_address">
          <colorPalette type="list">[#708794] </colorPalette>
        </format>   
Happy Splunking!

robertlynch2020
Motivator

perfect thanks 🙂

0 Karma

niketn
Legend

@robertlynch2020 here is another one of colorPalette option that would work. The expression type allows you to enter regular expression based matches for coloring table cells. PS: Complex regular expression does not seem to work.

    <format type="color" field="email">
      <colorPalette type="expression">if (value == ".*", "#708794", "#708794")</colorPalette>
    </format>

Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Color_palette_types_and_opti...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vnravikumar
Champion

Hi

Try this

<dashboard  script="table_cell_highlighting.js" stylesheet="table_cell_highlighting.css">
  <label>tablecolor</label>
  <row>
    <panel>
      <table id="highlight">
        <search>
          <query>| makeresults 
| eval no1=1, no2=2, email="test@test.com" 
| append 
    [| makeresults 
    | eval no1=4, no2=3, email="test1@test.com"] 
| table no1 no2 email</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>

      </table>
    </panel>
  </row>
</dashboard>

table_cell_highlighting.js:

  require([
      'underscore',
      'jquery',
      'splunkjs/mvc',
      'splunkjs/mvc/tableview',
      'splunkjs/mvc/simplexml/ready!'
  ], function(_, $, mvc, TableView) {

      var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
          canRender: function(cell) {
              return _(['email']).contains(cell.field);
          },
          render: function($td, cell) {
              var value = cell.value;
              if (cell.field === 'email') {
                      $td.addClass('range-cell').addClass('background');
              }
              $td.text(value);
          }
      });
      mvc.Components.get('highlight').getVisualization(function(tableView) {
          // Add custom cell renderer, the table will re-render automatically.
          tableView.addCellRenderer(new CustomRangeRenderer());
      });
  });

table_cell_highlighting.css: you can apply any required styles here

#highlight td.background {
    background-color: rgb(202, 204, 204) !important;
        font-weight: bold;
}
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...