In unedited form, Splunk dashboard tables are quite plain, which can make them hard to understand at a glance. Using colour to highlight certain values or trends helps users to understand what you are showing them, as well as looking more interesting.

In this blog post, I will focus on setting colours for a table, and modifying the default colour options given by Splunk. Keep an eye out for a future post on adding colours to charts!

Adding and modifying colours

There are three colour options available for tables – scale, range, and values. As a general rule the scale or range options work best for number values, while values are more useful for string values, or for columns where you know there are only a few possible values that could appear.

Splunk provides simple controls in the Dashboard editor for adding colours. Simply go into ‘Edit’ mode on the dashboard, and select the paintbrush icon in the header of the column you wish to apply colour to. The options are fairly self explanatory, and allow you to modify the colours used, and the data ranges or values they should be applied to, using a pre-selection of colours or a hex code input.

NOTE: A hex code is a 6 character hexadecimal code used to represent colour – you can find a variety of colour pickers online which can give you a hex code for any colour you like, and many of these tools can also generate palettes if you need some inspiration.

You can also edit the appearance of a table using Simple XML. This is especially helpful when applying the same settings to multiple tables, as the XML can easily be copied and pasted into the code for each table, without having to deal with the UI each time.

To access the Simple XML editor, go into ‘Edit’ mode on your dashboard and select ‘Source’ from the options at the top of the editor. Then find the <table> you want to edit, and copy or paste the relevant code in place – it can go anywhere within the block of code, but directly before the corresponding </table> tag is a good place if you are unsure.

An example of the Simple XML editor, with the formatting for table colouring highlighted.

You can edit criteria and hex codes by deleting and replacing the relevant values. Before editing any Simple XML, it’s a good idea to have a copy of the old XML ready to paste back in case of any problems!


The scale option offers a choice between sequential and divergent scales. There are also options to modify the min, mid and max points of the scale, which you may wish to change to suit your data.

A screenshot of a table in Splunk. The table is in Edit Mode, and options for scale colouring options are displayed.
Scale colour options in the Splunk dashboard editor UI.

The Simple XML code for this colour option is as follows:

<format type="color" field="column_name">
   <scale type="minMidMax" minType="number" minValue="60" maxType="percent" maxValue="100"></scale>
   <colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
  • ensure the field attribute in the <format> tag matches the column you want to highlight – this should match the name as it appears in the table precisely.
  • in the <scale> tag, you can specify the type and the value of the min, mid and max points on the scale by specifying the minType, midType and maxType and the minValue, midValue and maxValue attributes. Available types are number, percent or percentile.
  • in the <colorPalette> tag, you can edit the maxColor, minColor and optional midColor values.


This option allocates colours to a predetermined range of values. In the dashboard editor, you can easily specify the ranges and colours you wish to highlight.

Range colour options in the Splunk Dashboard editor UI.

The Simple XML is as follows:

<format type="color" field="column_name">
   <scale type="threshold">90,180,300</scale>
   <colorPalette type="list">[#53A051,#F8BE34,#F1813F,#DC4E41]</colorPalette>
  • ensure the field attribute in the <format> tag matches the column you want to highlight – this should match the name as it appears in the table precisely.
  • the <scale> tag should specify type="threshold", and list the upper limit for each range you wish to include, separated by commas. Min and max values will be appended to either end of the list.
  • the <colorPalette> tag should specify type="list", and provide a list of the colours for use in the chart, in the order that they should appear (from the smallest to the largest range). This list should be surrounded by square brackets, and comma separated.
    • If you want a gradient effect, you can achieve this by inputting only the lightest and darkest colour that you want to appear, and add the attribute interpolate="true" to the <colorPalette> tag
<format type="color" field="duration">
   <scale type="threshold">90,180,270</scale>
   <colorPalette type="list" interpolate="true">[#F56476,#003652]</colorPalette>
An example of a Splunk dashboard resulting from the above Simple XML


This method of adding colour to columns is the only one that works for non-numeric data. It can be really helpful when dealing with long strings as a way to highlight matching values, as well as providing a visual way to ‘group’ matching values together. Splunk will automatically provide colours for each value based on a pre-determined list – this can change which value is a certain colour when the page is refreshed, so using Simple XML or the UI to provide consistency is a good idea.

A Splunk dashboard coloured using the values option

The Simple XML to map values to specific colours is as follows:

<format type="color" field="column_name">
   <colorPalette type="map">{"value1":#62B3B2,"value2":#F8BE34,"value3":#5A4575}</colorPalette>
  • ensure the field attribute in the <format> tag matches the column you want to highlight – this should match the name as it appears in the table precisely.
  • the <colorPalette> tag should specify type="map". Map each value (in double quotes) to the colour you wish to use. This list should be surrounded by curly braces, and comma separated, with colons between the value and the colour.

A note on colours

When choosing colours to use on your dashboards, it’s best not to go overboard! It can help to choose a very few colours to use, and use the shade or intensity to convey meaning.

Splunk will automatically change the text colour based on the background, but be wary of choosing background colours which are too close to the background text, as this can be hard for some users to read.

You should also be aware that some of your dashboard users may be colour blind, and avoid either relying on colours alone to convey meaning, or using colours together which are known to be difficult for people to distinguish. There are tools which let you generate colour palettes and see how they appear to users with different forms of colour blindness, such as

Adding colour to a whole row

Sadly, there is no simple option in Splunk to add colour to a whole row of a table based on the value of a single cell. Luckily, there are workarounds! We’ve explored one of these in a previous post, which makes use of Javascript to add colour to the whole row. You can read more on this technique here.

For 2021 we’ve committed to posting a new Splunk tip every week!

If you want to keep up to date on tips like the one above then sign up below:

Subscribe to our newsletter to receive regular updates from iDelta, including news and updates, information on upcoming events, and Splunk tips and tricks from our team of experts. You can also find us on Twitter and LinkedIn.


* indicates required
Posted by:Becky Nielsen

Becky is a certified Splunk Admin, who has been working for iDelta since graduating from CodeClan's Professional Software Development course in 2019. Previously an archivist at several institutions around the UK, she holds an MSc in Information Management and Preservation from the University of Glasgow.

2 replies on “Adding colour to your dashboards: Part 1 – tables

Comments are closed.