Color coding for values by rows

bharathkumarnec · ‎08-30-2018

Hi All,

I have two to three rows, something like below:

ABC 98 97 67
DEF 50 45 23
GHI 3 2 1

three rows of a table is as shown above.

Now i need to apply three color codings to each row based on ranges.

For example: First Row --> >90 Green 80 to 90 Yellow & <80 red
Second row > 45 Green 30 to 45 Yellow <30 red
Third row >3 Green 2 to 3 Yellow <1 red

Kindly provide an easiest way to achieve this.

TIA

Regards,
BK

mstjohn_splunk · ‎08-31-2018

hi @bharathkumarnec ,

Did @pyro_wood 's answer solve your problem? If so, please resolve this post by approving one of them. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂

bharathkumarnec · ‎09-19-2018

Hi @pyro_wood, This did not solve my problem!

horsefez · ‎08-30-2018

Hi @harathkumarnec,

there is a wonderful dashboarding app out there on splunkbase.splunk.com that helps you with coloring field values based on ranges.
I'm talking about the Splunk App "Dashboard Examples"

If you are able to install that on your system you should do, because it gives you all the configuration you need.
https://splunkbase.splunk.com/app/1603/

FANCY:
When you installed it open it up and scroll down to one of the examples that is named "Table Cell Highlighting" or "Table Row Highlighting"

It's the fancy stuff with JS and CSS.

SIMPLE:
If you want SIMPLE and not particularly fancy you can also try out this:

<dashboard>
  <label>Table Formats</label>
  <description>Format columns using built-in table formats (coloring, number formatting).</description>
  <row>
    <panel>
      <table>
        <search>
          <query>
            index=_internal | stats count by sourcetype
          </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <format type="color" field="sourcetype">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#31A35F" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
      </table>
      <html>
        <ul>
          <li>"sourcetype" column is using automatic color setting based on cell values.</li>
          <li>"count" column is using scaled color with preset color palette.</li>
        </ul>
      </html>
    </panel>
    <panel>
      <table>
        <search>
          <query>
            index=_internal | stats count by sourcetype
          </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <format type="color" field="sourcetype">
          <colorPalette type="map">{"splunkd":#F7BC38,"scheduler":#6A5C9E}</colorPalette>
        </format>
        <format type="color" field="count">
          <colorPalette type="list">[#65A637,#6DB7C6,#F7BC38,#F58F39,#D93F3C]</colorPalette>
          <scale type="threshold">0,30,70,100</scale>
        </format>
      </table>
      <html>
        <ul>
          <li>"sourcetype" column is using custom defined colors based on individual cell values.</li>
          <li>"count" column is using custom defined colors based on cell value ranges.</li>
        </ul>
      </html>
    </panel>
    <panel>
      <table>
        <search>
          <query>
            | inputlookup splunk-stock.csv
            | fields date, volume
          </query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <format type="number" field="volume">
          <option name="precision">0</option>
          <option name="useThousandSeparators">true</option>
          <option name="unit">$</option>
          <option name="unitPosition">before</option>
        </format>
      </table>
      <html>
        <ul>
          <li>"volume" column is using number formatting including: precision, thousand separator, unit. </li>
        </ul>
      </html>
    </panel>
  </row>
</dashboard>

bharathkumarnec · ‎09-19-2018

Hi @Pyro_wood,

Context X Y Z
ABC 98 97 67
DEF 50 45 23
GHI 3 2 1

So, if Context is ABC, i have to apply color coding for X,Y,Z & if the context is DEF, another color coding need to be applied and so on.....

Also the X,Y&Z are not only three columns, i have n number of columns like that and sometimes these are dynamic and not static.

Regards,
BK

Color coding for values by rows

Updated Team Landing Page in Splunk Observability

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...