Hi,
I have the search below and it works great. It outputs a table with the customer name, then a trendline, and then a percentage.
earliest=-24h index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name=broadband |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |chart sparkline(avg(stat_val)) as Trend last(stat_val) as "Broadband Connectivity %" by mso|rename mso as Customer
What I'd like to do is highlight the LOWEST percentage value. I know this can be done with that stats table formatting, but Splunk uses RED for the HIGHEST value and BLUE for the LOWEST value (seems like they chose temperature colors). I'd like to highlight/identify the lowest value either with a yellow highlight (similar to the events) or RED text color.
Have a look at the "Table Cell Highlighting" example on the "Splunk 6.x: Dashboard Example" app.
App available here: https://splunkbase.splunk.com/app/1603/
It requires custom java scripts (script includes the field name) and css to be written.
Hi dbcase,
install the dashboard example app https://splunkbase.splunk.com/app/1603/ and have a look at the Table Element with Data Overlay
examples found here:
http://yoursplunkserver:8000/en-US/app/simple_xml_examples/simple_table_data_overlay?earliest=0&late...
Hope this helps ...
cheers, MuS
This is the one that is part of the table formatting. It is in the right ballpark but not quite. For the high value it uses the color RED which in this case is misleading. I'd like the LOW value to be RED so it will draw attention
Have a look at the "Table Cell Highlighting" example on the "Splunk 6.x: Dashboard Example" app.
App available here: https://splunkbase.splunk.com/app/1603/
It requires custom java scripts (script includes the field name) and css to be written.