Splunk Search

How to set color to result if output is less than equal to current date

himanshuqb
Loves-to-Learn

I wan to set color  for output of column if it's date matches current or two days before current date. 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This sort of question has been answered multiple times - essentially, the technique is to use a multi-value field with a calculated value e.g. based on the dates in the event in your instance, set the colour based on this value and use CSS to hide the multivalue element

How-to-change-table-cell-background-color-depends-on-search 

0 Karma

himanshuqb
Loves-to-Learn

The value i want to use is _time or time with %Y%d%m, i checked many posts and found only static values which were used how can we use _time or _time -2.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval time=if(relative_time(_time,"@d")=relative_time(now(),"@d"),mvappend(strftime(_time,"%Y-%m-%d"),"today"),if(relative_time(_time,"@d")=relative_time(now(),"-2d@d"),mvappend(strftime(_time,"%Y-%m-%d"),"two days ago"),strftime(_time,"%Y-%m-%d")))
0 Karma

himanshuqb
Loves-to-Learn

Thanks, but i was looking for something which i can use in color option to color anything today or two days before to something. What i'm looking for is how to use 

<format type="color" field="time-check"> <colorPalette type="expression">case (like(value,"%_time%"),"#FF5733")</colorPalette> </format> 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
        <format type="color">
          <colorPalette type="expression">if (relative_time(strptime(value,"%Y%m%d"),"@d")=relative_time(now(),"@d") OR relative_time(strptime(value,"%Y%m%d"),"@d")=relative_time(now(),"-2d@d"),"#FF5733",null())</colorPalette>
        </format>
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...