Splunk Search

How to use token in <scale> tag?

mxh7777
Path Finder

Hi,

I have a dashboard with table and some columns with colorPalette and scale

I'd like to set dynamically the range of the scale for the colorPalette using a text input

I did that but not working

<input type="text" token="myValue" searchWhenChanged="true">
<label>Value Scale</label>
</input>

...

...

<format type="color" field="transaction/arbitrage_v2.0">
<colorPalette type="list">[#FFFFFF,#D41F1F]</colorPalette>
<scale type="threshold">$myValue$</scale>
</format>

but myValue is not interpreted

Is it possible to solve ?

 

Thanks in advance

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can certainly use tokens almost anywhere in a dashboard, including inside embedded CSS and other formatting places - but not ALL.

HOWEVER, for some odd reason it does NOT appear to work in the <scale> definition of a threshold colorPalette.

Don't worry though, you can still achieve it this way, but using an expression type.

<format type="color" field="myValue">
  <colorPalette type="expression">if(value>$sc$, "#FFFFFF", "#D41F1F")</colorPalette>
</format>

You can also use case statements and have a bunch of case statements where you can define different colours.

Note also that you can use tokens in place of the fixed colour definitions. I often use this to load a colour schema from a settings file into tokens and then I can change all the colour scheme of a dashboard just by changing the settings (CSV) file.

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I believe that tokens are used for queries, not other elements in dashboard.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...