Is there an If elseIf feature I can use for determining what color to make a cell using collorPalette?
i'm looking for something like
<format type="color" field="msg">
<colorPalette type="expression">
if (like(value,"%something%") OR like(value,"%something1%"), "#008000", "#FFFFFF")
elseIf (like(value,"%something2%") OR like(value,"something3"), "#FF6347", "#FFFFFF")
</colorPalette>
</format>
@splunkhelp123
Can you please try below XML?
<format type="color" field="data">
<colorPalette type="expression">case(value=="something" OR value=="something1","#008000",value=="something2" OR value=="something3","#FF6347",1=1,"#FFFFFF")</colorPalette>
</format>
If you have multiple if conditions then it is better to use case.So I have used case instead of if. I have provided a simple direct comparison with data.
My Sample Dashboard:
<dashboard>
<label>colorPalette</label>
<row>
<panel>
<table>
<search>
<query>| makeresults | eval data="something,something1,something2,something3,somethin4" | eval data=split(data,",") |mvexpand data</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="data">
<!--colorPalette type="expression">case(match(value,"something") OR match(value,"something1"),"#008000",match(value,"something2") OR match(value,"something3"),"#FF6347",1=1,"#FFFFFF")</colorPalette-->
<colorPalette type="expression">case(value=="something" OR value=="something1","#008000",value=="something2" OR value=="something3","#FF6347",1=1,"#FFFFFF")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Thanks
Here, I have commented on a match expression.bcoz it will match the first condition always. You can try it by uncommenting it.