I've read through a lot of articles, but I can't figure out how to make this work. My query is below. For ease of reading I deleted the majority of the eval part of the statement that write a static SLA column. I want to highlight the cell in the DailyTotal column in red if it is greater than the DailyCountSLA. How can I do this please? Any help is appreciated!
loggingAppId=ABC | eval callingAppAndOperation=callingAppId.".".loggingOperationName | eval DailyCountSlaValue=case(callingAppAndOperation=="XYZ.ExecutionStatus",3000, 1=1,0| bin _time span=1d |stats count As DailyTotal, avg(DailyCountSlaValue) AS DailyCountSLA by _time, callingAppAndOperation | eval DailyCountSLA=round(DailyCountSLA,0) | sort -HourlyTotal | dedup callingAppAndOperation | sort callingAppAndOperation
Hi @jsights,
Have you checked this one?
https://answers.splunk.com/answers/661894/how-to-color-cell-contents-with-css-and-js.html
https://answers.splunk.com/answers/686288/how-do-you-highlight-a-table-cell-based-on-a-field.html
You have to just change javascript, css class and search query.
Let me know if any further help required.
Thanks