Dashboards & Visualizations

Changing the color of a table row if the response time is greater than the threshold

agrant21
Loves-to-Learn

I created a table that outputs the organization,  threshold, count, and response time. If the response time is greater than the threshold, then I want the  response time  value to turn red. However, the threshold is different for every organization. Is there a way to dynamically set the threshold on the table for the Response Time column to turn red based on its respective threshold. 

 

For example, organization A will have a threshold of 3, while organization B will have a threshold of 10.  I want the table to display all the organizations,count, the response time, and the threshold. 

 

index | stats count as "volume" avg as "avg_value" by organization, _time, threshold

 

Kindly help. 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do it, but it's a little fiddly - it involves making the response value a multivalue field with the response value as the first element and an indicator whether it's over threshold saved as the second value.

Using CSS you stop the second value from being displayed, then use the standard colorPalette settings to set the colour.

Here's an example panel that demonstrates how

    <panel>
      <html depends="$hidden$">
        <style>
          #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
      <table id="coloured_cell">
        <title>Colouring a table cell based on it's relative comparison to another cell</title>
        <search>
          <query>
| makeresults count=10
| fields - _time
| eval Threshold=random() % 100, Value=random() % 100
| eval Comparison=case(Value &lt; Threshold,-1, Value &gt; Threshold, 1, true(), 0)
| eval Value=mvappend(Value, Comparison)
| table Threshold Value
          </query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <format type="color" field="Value">
          <colorPalette type="expression">case(mvindex(value, 1) == "1", "#ff0000", mvindex(value, 1) == "-1", "#000000", true(), "#00ff00")</colorPalette>
        </format>
      </table>
    </panel>

 It will make a field called Comparison which is -1 if the Value is < Threshold, =1 if Value is > Threshold otherwise 0. This is appended to the real value field

Then the <colorPalette> statement will test the mvindex(..1) which gives the Comparison number and the expression defines the colour.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...