Splunk Search

How can I define column-color when I do not know in advance what my fields are named?

Jaff
New Member

I want to query data collected from running containers, indexed into a data set. The particular results will be presented as a table, with each column representing a combination of "datacenter-environment", where the choices are made from a multi-select input. Choices of datacenter can be one or more of up to 10, while each datacenter can have from one to many environments available. For example, I could choose from:

tec1-shared
tec2-shared
tpa3-shared
tec1-usqe1
tpa3-csa1
tea2-core
tec1-core
tea4-core
tpa3-core
tec2-core

And compare, for example, tpa3-core with tec2-core and tec1-core. Right now, I've hard-coded a few combinations into a dashboard, with a sample like:

<format type="color" field="tea2-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="tec1-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="tea4-core">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>

But this solution does not scale for the many more different combinations. Is there a way to define column-color that could be applied to any combination of selected inputs, without requiring a custom-view?

I've temporarily hacked a solution, by eliminating the field designation in the format, so the colors are applied to ALL columns, but aesthetically, the first column, container should NOT be colored:

<format type="color">
  <colorPalette type="sharedList"></colorPalette>
  <scale type="sharedCategory"></scale>
</format>
<format type="color" field="container">
  <scale type="linear"></scale>
  <colorPalette type="list">[#FFFFFF,#FFFFFF]</colorPalette>
</format>

Unfortunately, since there does not seem to be a way to over-ride the first format, as it applies to ALL columns, this is not the ideal solution

0 Karma

Jaff
New Member

Changing the scale to be category fixed it!

<format type="color" field="container">
  <scale type="category"></scale>
  <colorPalette type="list">[#FFFFFF,#DCDCDC]</colorPalette>
</format>
0 Karma

kulick
Path Finder

Maybe accept above answer for karma? 😉

0 Karma

kulick
Path Finder

I think you need to be sure that your data in field 'container' is numeric if you use...

<scale type="linear"></scale>

Maybe try...

<scale type="category"></scale>

...instead for non-numeric data.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...