Splunk® Enterprise

Splunk Dashboard Studio

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Selector and formatting functions

You can use selector and formatting functions in the dynamic options syntax (DOS) to specify which aspects of the data you want to reflect in your visualizations.

Selector functions

Selector functions select the data of interest when configuring a dynamic option. The following are common selector functions.

Selector Description
max() Finds the global maximum value in the data series.
min() Finds the global minimum value in the data series.
seriesByIndex(index) Returns the data series at the given index. Index in this context refers to the numerical index as it relates to returned fields. For example, in a table of results, the first field is index = 0, the second field is index = 1, and the third field is index = 2.
seriesByName(field) Finds series in the data source results by field name.
seriesByType(type) Finds series in the data source by first data type match.
delta(index) Finds the delta between the last point and the point at the given index. Index in this context refers to the numerical index. A negative index can be used, indicating an offset from the end of the sequence.
firstPoint() Returns the first dataPoint in series.
lastPoint() Returns the last dataPoint in series.

Formatting functions

Formatting functions transform and map the data into the desired format. The following are common formatting functions.

Formatter Description Context Options
gradient() Based on stops and colors, this formatter maps the value to an associated color.
"gradientConfig": {
  "stops": [0,100,230],
  "colors": ["red", "green", "blue"]
}
"colorOption": "> primary | seriesByIndex(0) | gradient(gradientConfig)"
matchValue() Maps each element in the data series to find a corresponding match value and returns the matched value if found, or the default value if present.
"colorMatches": [
  {
    "match": "critical",
    "value": "red"
  },
  {
    "match": "moderate",
    "value": "orange"
  },
 {
    "match": "low",
    "value": "green"
  }
]
"colorOption": "> majorValue | matchValue(colorMatches)"
rangeValue() Takes the list of ranges and a default value (if no range is found) and assigns a color value based on the threshold.
"colorThresholds": [
  {
    "from": 1321,
    "value": "#FF0000"
  },
  {
    "to": 1321,
    "value": "#00FF00"
  }
]
"colorOption": "> deltaValue | rangeValue(colorThresholds)"
Last modified on 24 July, 2023
PREVIOUS
Visualization configuration options
 

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters