color code a result on a table

[rajbahak]

Hey there,

Wanted to find out how could I color code a row in a table depending on the results. For example, I have a table showing free disk space of select servers. See below for the screen shots (host names have been erased). I'd like to be able to highlight a row if a 'free' value goes below certain threshold. The purpose is to put this view up for operations team for example, who'd know when a disk on a server is filling up real quick just by looking at the visual alert such as a colored row in red.

Thanks for your time/help.

[sideview]

I suspect if you look again, you'll see quite clearly that your view is specifying that both a SimpleResultsTable module and a Table module should be there.

[rajbahak]

by now you would have probably guessed my level of expertise in Splunk.. 😄 Sorry, it seems like I am having you to babysit me through this. But what I am seeing now is a bit bizarre. I got past the 'Loading.' stage after including the SideviewUtils module, but I now get two tables, and one of them seem like a static table with no drill downs, and the other one looks like a normal splunk results table.. what is happening??

[sideview]

Do you have the SideviewUtils module also in there, tucked up near the top out of the way? If you've forgotten to include the invisible SideviewUtils module at the top, this is exactly what happens - Loading gets stuck at the top and there's a JS error in the console saying "Sideview is not defined". There's a couple little things you have to know, that are listed on the Sideview Utils homepage and that's one of them.

[rajbahak]

don't think I am doing it right. I have the sideview utils app installed. And as soon as I include the table module in the dashboard, save it and come out of the editor, the dashboard won't load. All I get is a Loading... tab. you can see the result in the screen shot below.

what do you think is going on here?

[rajbahak]

thanks a lot for your replies. I'll look into the sideview app

Usup

[sideview]

You can use the Table module from Sideview Utils. The Table module has a param called 'rowClass' that allows you to set the CSS classname of each row based on one or more fields from the row's data. It also has a 'hiddenFields' param, so that the special field value(s) used in the classname isn't actually visible to the user.

You would need to apply a little search language to generate the field, either in your base search or using postProcess,

| eval myClassField=if(free<100,"low","normal")

and then your Table module would look like this:

<module name="Table">
  <param name="rowClass">$row.fields.myClassField$</param>
  <param name="hiddenFields">myClassField</param>
</module> 

and that's all she wrote. There are some docs about this in Sideview Utils although there will be more docs coming over the next few releases.

UPDATE: I forgot to mention the third part, putting in the actual Custom CSS to define what class="low" should do on the page. 😃

Most commonly people write custom CSS by adding it to the application.css file that lives in etc/apps//appserver/static/application.css

you would for instance add this to that file:

.Table tr.low td {
    background-color:#ffdddd;
}

http://sideviewapps.com/apps/sideview-utils/

[ChrisG]

Would araitz's previous Answer do the trick?