Format table field with a space in the column name

[helge]

I would like to use the Simple XML format rule to specify the formatting of table columns as documented here, e.g.:

<format type="number" field="count">
  <option name="precision">3</option>
  <option name="unit">MB</option>
</format>

How do I specify a field name with a space in it? Does that even work?

My table would be defined as follows:

SOME_SPL | table "fieldname with spaces"

[akarivaratharaj]

Hi @helge ,

I have a field called "TOTAL_TIME" which is in the format of "HH:MM:SS" and I am trying to apply the color format to it. But the color is not getting applied.

Could you please help me in getting the code to apply the color for the time format.

Thankyou.

[GDude]

Hy, is there a way to color fields of a table by an other field? I have created a field with colors und want to apply this to the Numbers of an other field. Thanks in advance. George

[GDude]

Sorry, I missed that you were only discussing fields with spaces. I'll place a new question.

[helge]

You should post this as a new question. Mixing topics is a no-no.

[vasanthmss · Accepted solution]

Yes. field name with space you can use in the format. Sample is below,

<dashboard>

  <row>
    <panel>

      <table>

        <search>
          <query>index=_internal | head 100 | bin span=1d _time | stats count by _time sourcetype |rename sourcetype as "Source Type"</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>

        <format type="color" field="Source Type">
          <colorPalette type="map">{"splunkd":#6DB7C6,"splunk-access":#F7BC38,"s":#AFEEEE}</colorPalette>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#31A35F" midColor="#A2CC3E" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

[helge]

Not adding additional quotes in some way is the one thing I did not try 😉

[DalJeanis]

It's great to include working code in your answer. It might have been easier for the poster to understand your answer if you'd also told him what field name to look for in your HTML - which is "Source Type" in this instance.

Or just told him -

 <format type="number" field="fieldname with spaces">