Splunk Search

color statistic table cell dynamically on certain rule using other field value

Abhineet
Loves-to-Learn Everything

Want to change color of statistic table cell value on certain rule using other field.

TABLE:

Region, Device, Service, Leased License, Reserved License, Maximum License, Current Users

CHINAAMCDPVPN1DESKTOP170017002000638
 SCLAMPVPN1 1001002000
Republic Of KoreaAMKDPVPN1DESKTOP100010001300294
INDIAAMINDDPVPN1DESKTOP2200190025002083
SCLASCLADPVPN1DESKTOP400040005000549

 

"current users" cell should have color as below mentioned rule.

1. RED: if "Current Users" greater than or equal to "Reserved License"

2. YELLOW: if "Current users" greater than  85% of  "Reserved License" and less than "Reserved License" 

3. GREEN: If "Current users" less than  85% of  "Reserved License"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Make current users a multi-value field with the second value evaluated to the colour you want (dependent on the conditions you mentioned). Then format the field colour based on the colour, and add CSS to hide the second multi-value in the current users column. See my solution to this post https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu... 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...