Splunk Search

Using wild card in table column formating

splunkuser320
Explorer

I want to change the column cell background based on the value, but I also want to use a wild card.

Example Field values

Passed (12:20)

Failure (2:30)

Passed (4:40)

I want to change the cell color based on only Passed and Failure and ignore rest of the string.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If this was a solution for you, please mark it as solved, so others can benefit.

View solution in original post

0 Karma

splunkuser320
Explorer

Its works. Thanks for your help!!!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If this was a solution for you, please mark it as solved, so others can benefit.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use the colorPalette format option

<format type="color" field="your_field">
<colorPalette type="expression">case(match(value,"^Passed"), "#008000", match(value, "^Failed"), "#F8BE34", true(), "#000")</colorPalette>
</format>

See the documentation here

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML#Color_palette_types_and...

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...