Splunk Search

Multiple different font colors in one cell / string

Cydraech
Explorer

Hello people,

I'm very new to Splunk and I'm trying to create a dashboard with the "Statistics Table" Visualisation, that is more compact and takes up less space than what was there before.

In order to achieve this, I'm concatenating several strings from different fields, kind of like this:

| eval compactfield="1. ".field1."

2. ".field2."

3. ".field3

and while that looks fine and works, it'd be great if I could add some kind of color tag (or maybe even bold, italic and so on) so that there'd be a different color for each line, making it easier to differentiate for people looking at the dashboard. I'm imagining something like this:

| eval compactfield="<col="blue">1. ".field1."

</col><col="red">2. ".field2."

</col><col="purple">3. ".field3."</col>"

Is there a way to achieve this? I'm really sorry if this question has been asked before, but I couldn't find anything.

Thanks for your time,

Cyd 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It can't be done with the standard table viz - you might be able to write some html panels but I suspect it would get overly complicated for little benefit.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

It can't be done with the standard table viz - you might be able to write some html panels but I suspect it would get overly complicated for little benefit.

Cydraech
Explorer

Thanks for your answer!

I reckon that your assessment of the output not justifying the input is right. If there's no quicker way to do it, then - especially as a beginner - I don't think I should waste any more time on it. Maybe I'll revisit this later down the line, who knows.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is potential for using CSS to style your cells, e.g. background colour based on the content of the field.  If you use multi-value fields, you could also hide (display: none;) on some of the multi-value indexes.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...