Splunk® Enterprise

Splunk Dashboard Studio

Splunk Enterprise version 8.2 is no longer supported as of September 30, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Selector and formatting functions

You can use selector and formatting functions in the dynamic options syntax (DOS) to specify which aspects of the data you want to reflect in your visualizations.

Selector functions

Selector functions select the data of interest when configuring a dynamic option. The following are common selector functions.

Selector Description
max() Finds the global maximum value in the data series.
min() Finds the global minimum value in the data series.
seriesByIndex(index) Returns the data series at the given index. Index in this context refers to the numerical index as it relates to returned fields. For example, in a table of results, the first field is index = 0, the second field is index = 1, and the third field is index = 2.
seriesByName(field) Finds series in the data source results by field name.
seriesByType(type) Finds series in the data source by first data type match.
delta(index) Finds the delta between the last point and the point at the given index. Index in this context refers to the numerical index. A negative index can be used, indicating an offset from the end of the sequence.
firstPoint() Returns the first dataPoint in series.
lastPoint() Returns the last dataPoint in series.

Formatting functions

Formatting functions transform and map the data into the desired format. The following are common formatting functions.

Formatter Description Context Options
gradient() Based on stops and colors, this formatter maps the value to an associated color.
"gradientConfig": {
  "stops": [0,100,230],
  "colors": ["red", "green", "blue"]
}
"colorOption": "> primary | seriesByIndex(0) | gradient(gradientConfig)"
matchValue() Maps each element in the data series to find a corresponding match value and returns the matched value if found, or the default value if present.
"colorMatches": [
  {
    "match": "critical",
    "value": "red"
  },
  {
    "match": "moderate",
    "value": "orange"
  },
 {
    "match": "low",
    "value": "green"
  }
]
"colorOption": "> majorValue | matchValue(colorMatches)"
rangeValue() Takes the list of ranges and a default value (if no range is found) and assigns a color value based on the threshold.
"colorThresholds": [
  {
    "from": 1321,
    "value": "#FF0000"
  },
  {
    "to": 1321,
    "value": "#00FF00"
  }
]
"colorOption": "> deltaValue | rangeValue(colorThresholds)"
Last modified on 24 July, 2023
Object options and defaults reference  

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters