Hi,
I have a table with 2 columns and I want to change the colour of one of them based on whether or not its bigger or smaller than the second column.
For example, in the table below, I would expect the first 2 rows of column1 to be green, while the last 2 rows will be red:
field1, field2
100, 200
12, 5000
200, 100
9999, 2
I've taken 2 approaches, configuring colorPalette with a variable from my search directly which seemed to not work, secondly tried to update a token through the search because one of the links below suggests that tokens will work.
I've used these posts as references to no avail still:
https://answers.splunk.com/answers/656201/can-i-use-if-match-x-regex-y-z-in-a-colorpalette-e.html
https://answers.splunk.com/answers/469742/how-to-edit-dashboard-to-use-token-values-to-deter.html
https://answers.splunk.com/answers/673787/how-to-set-a-token-based-on-search-results.html
Here's my sample dashboard:
<form theme="dark">
<row>
<panel>
<title>Random title</title>
<table>
<search>
<query>
index=someIndex source=someSource| eval field1=bla, field2=bla | table field1 field2
</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<done>
<set token="tokStatus">$result.field1$</set>
</done>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="latency">
<colorPalette type="expression">if(value > $tokStatus$, "#53A051", "#DC4E41")</colorPalette>
</format>
</table>
</panel>
</row>
</form>
Any ideas on how to do so?
... View more