Solved: Re: How do I apply a format color rule based on an...

ejwade · ‎01-19-2023

For a table panel, I would like to create a format rule (<format>) of type="color" that sets a threshold based on another field's data.

Here is a sample search (note - "streamstats" and "count_stream" are used just to get sample data):

| makeresults count=3 
| streamstats 
    count AS count_stream 
| eval count_total = count_stream * 10
    ,count_metric = count_stream * count_stream * 2 
| eval perc_metric = count_metric / count_total * 100
| table perc_metric count_metric, count_total

I would like to create color rules for the "count_metric" field/column, but base it on the "perc_metric" value. My goal is to leverage the percentage values in "perc_metric," and apply color to the cells in "count_metric," hiding the "perc_metric" field/column in the final output.

Here's my Simple XML

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=3 
| streamstats 
    count AS count_stream 
| eval count_total = count_stream * 10
    ,count_metric = count_stream * count_stream * 2 
| eval perc_metric = count_metric / count_total * 100
| table perc_metric count_metric, count_total</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="perc_metric">
          <colorPalette type="list">[#DC4E41,#F1813F,#53A051]</colorPalette>
          <scale type="threshold">21,41</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

ITWhisperer · ‎01-19-2023

You could do something like this

<dashboard>
  <label>Colour cells</label>
  <row>
    <panel depends="$stayhidden$">
      <html>
        <style>
          #tableCellColour table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
    </panel>
    <panel>
      <table id="tableCellColour">
        <search>
          <query>| makeresults count=3 
| streamstats 
    count AS count_stream 
| eval count_total = count_stream * 10
    ,count_metric = count_stream * count_stream * 2 
| eval perc_metric = count_metric / count_total * 100
| eval count_metric=mvappend(count_metric, perc_metric)
| table count_metric, count_total</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="count_metric">
          <colorPalette type="expression">case(mvindex(value,1) &lt; 21, "#DC4E41", mvindex(value,1) &lt; 41, "#F1813F", 1=1, "#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

Peter_25KM · ‎03-20-2023

@ITWhisperer I was inspired by the your suggestion but instead comparing values from two cells.
If n1 is smaller than n2 then color it green otherwise color it red.
But it is sometimes setting an incorrect color.
Can you help me to identify what I am doing wrong?

<dashboard version="1.1">
<label>Colour cells</label>
<row>
<panel>
<table id="tableCellColour">
<search>
<query>| makeresults count=10
| eval n1 = (random() % 100) + 1
| eval n2 = (random() % 100) + 1
| eval nn = mvappend(n1, n2)
</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="nn">
<colorPalette type="expression">case(mvindex(value,0) &lt; mvindex(value,1), "#1ce354", 1=1, "#de2121")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

ITWhisperer · ‎03-20-2023

It looks like there was a typo in my original solution - the last comparison in the case statement should be 1==1 not 1=1.

ITWhisperer · ‎01-19-2023

You could do something like this

<dashboard>
  <label>Colour cells</label>
  <row>
    <panel depends="$stayhidden$">
      <html>
        <style>
          #tableCellColour table tbody td div.multivalue-subcell[data-mv-index="1"]{
            display: none;
          }
        </style>
      </html>
    </panel>
    <panel>
      <table id="tableCellColour">
        <search>
          <query>| makeresults count=3 
| streamstats 
    count AS count_stream 
| eval count_total = count_stream * 10
    ,count_metric = count_stream * count_stream * 2 
| eval perc_metric = count_metric / count_total * 100
| eval count_metric=mvappend(count_metric, perc_metric)
| table count_metric, count_total</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="count_metric">
          <colorPalette type="expression">case(mvindex(value,1) &lt; 21, "#DC4E41", mvindex(value,1) &lt; 41, "#F1813F", 1=1, "#53A051")</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

kumaranv · ‎02-10-2024

Excellent. Thanks

ejwade · ‎01-20-2023

@ITWhisperer- this is great! Very clever - thank you for the solution!

How do I apply a format color rule based on another field's data?

simple XML

table

Archived Metrics Now Available for APAC and EMEA realms

Detecting Remote Code Executions With the Splunk Threat Research Team

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!