Splunk Search

coloring a row based on field value(with a wildcard/space)

smolcj
Builder

hi,
for changing the color of a field we can change the css to
.Table tr.informational td {
background-color:#72c72d;
color:#fff;
}
what if the field name is having some space or if we have to add a wild card in the field value like
.Table tr.informational 1 td {
background-color:#72c72d;
color:#fff;
}

why i need wildcard because it can be informational 2 informational 3... etc.. something like info*.. is it possible?
Please help
Thank you

0 Karma

sideview
SplunkTrust
SplunkTrust

In this question you're asking about the "rowClass" param of the Sideview Table module, and for those following along this question came from a comment on this other question - http://splunk-base.splunk.com/answers/60993/colorize-simpleresultstable-rows-based-on-field-values.

The value of the Table module's rowClass param, as calculated at runtime can contain spaces, whether or not those spaces come from the dynamic field value(s) present by virtue of $fieldName$, or from hardcoded parts of the string. However in CSS a space in there means that multiple classes are being applied indepently to the element. EG: if the rowClass value were "informational 1", then you'd be applying two classes independently, "informational", and "1". Each of those classes you'd have to define in your stylesheet, and needless to say "1" is a very strange classname to use.

To simplify this, I would stay away from spaces in the fieldnames that you're using in rowClass. Specifically I would use | eval myClassField=replace(myClassField," ","_") either in the base search or in a postProcess search, to turn those values into "informational_1", "informational_2", etc.. That will mean they act as a single class and you can define those informational_1, informational_2, informational_3 in your CSS.

sideview
SplunkTrust
SplunkTrust

No it is not. No such mechanism exists in CSS and in fact the "" character has its own meaning in CSS that would confuse things even further. Granted, if you let the "informational 1" values come down as rowClass values, you'd *get your wildcard behavior in the form of the "informational" class. You could leave the "1", "2" classes undefined and your "informational" class might work as the wild card you're wanting?

0 Karma

smolcj
Builder

so a wildcard idea is not possible here?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...