Change Table Header Color Based On Values Present In The Table
Let’s try to understand first what we are going to do today. So we have a table like this,
index=_internal sourcetype="splunkd" | stats count by sourcetype
The above table is showing only the count of “splunkd” sourcetype.
Now whenever the “count” field will have more than zero count table header color will be “Green”, if the count is zero then the header color will be “Yellow”.
Before going to the exact requirement let’s create a dropdown that can create the similar kind of scenario we want for the use case.
We have created a dropdown with the “sourcetype” token and two static values “splunkd” and “invalid”. And we have passed the token within our panel.
I.e. whenever we will select “splunkd” it will show count, and if we select “invalid” it should show zero. It is the exact scenario we need for our use case.
Now currently if we select “invalid” it’s showing “No Results Found”, like this
To overcome this we need to modify our query a bit,
index=_internal sourcetype="$sourcetype$" |stats count by sourcetype | appendpipe [stats count | where count=0]
Now if we select “invalid” it will show like this,
Instead of showing “No results found”, it’s showing count=0. That is exactly what we want.
Now let’s move to our exact use case,
Click on “Edit” and go to “Source”.
Now do these following changes as shown below.
Explanation:
At the beginning [from line 12 to 13], we have created a new row where we have used a customized html code to set a color to the table header by taking the “.table th” component. We have used the “background-color” option to set colors and defined a token “th_color”.That particular token is setting up from line 28 to 35, where we have used a couple of conditions that if the count is greater than zero it will pass “green” else it will pass “yellow”.
Result:
Happy Splunking!!
