topic IT Service Intelligence: How to change the color based on the value of a field (state)? in Splunk ITSI

IT Service Intelligence: How to change the color based on the value of a field (state)?

DataOrg — Tue, 21 May 2019 12:01:44 GMT

Below is the data I have in search time. I have the entity as a state column.
How can I make running as Green and Stopped as Red ?

ServiceType="Own Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=20088

Re: IT Service Intelligence: How to change the color based on the value of a field (state)?

adonio — Tue, 21 May 2019 12:25:55 GMT

if you are asking regarding a KPI, i would probably convert the value of State field to a number
for example:
... your search ... | eval status=if(State''"Running",0,1) ...
then on the KPI i will have the max function and the field to report as status
when defining thresholds, normal will be 0 and High or Critical will be 1

hope it helps

Re: IT Service Intelligence: How to change the color based on the value of a field (state)?

DataOrg — Tue, 21 May 2019 12:51:55 GMT

but in the KPI tile. the status will be shown as numeric value as 1 or 0. it there any way i can display the state and to calculate i can use status value?

Re: IT Service Intelligence: How to change the color based on the value of a field (state)?

adonio — Tue, 21 May 2019 12:58:36 GMT

ITSI KPIs working only on numeric values, you cant put a string (per-se) in the visualization as far as i know
meaning, you cant have a text in the KPI viz box