I am running a search like this:
| makeresults | fields - _time | eval data = "Susan|Developer|Software,Chris|Admin|Server,Bob|Developer|Software,Tina|Admin|Server,Chris|Developer|Software" | table data | makemv delim="," data | mvexpand data | rex field=data "^(?<Employee>[^\|]*)\|(?<Role>[^\|]*)\|(?<Department>.*$)" | fields - data | xyseries Department, Employee, Role
What I need is to be able to color cells in the final table based on user roles - like green for Developer, blue for Admin etc.
The problem is the field names are dynamic and I cannot find a way to set coloring options for such fields. I know it's tricky any thoughts? I'd prefer a non-HTML, non-Javascript solution as I am hosted in SplunkCloud.
I've tried field="*" in the format tag but it doesn't work.
<format type="color" field="*">
<colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
</format>
... View more