topic Re: SingleValue Panel - replace Value with Text in Dashboards & Visualizations

SingleValue Panel - replace Value with Text

nwe — Thu, 21 Feb 2013 09:20:16 GMT

Dear all,

I created SingleValue Panels on my dashboard which shows me a status of a Application. This is my search:

... | stats count as errors | rangemap field=errors low=0-0 default=severe  | replace 0 with "Service OK"

I replaced 0 with Service OK because it looks better on the monitoring TV. This works fine but I cannot change values > 0 to Service NOK. The replace function only works with string. So if Splunk counts errors, it shows me a number on my dashboard. I want to keep rangemap in my search because I want a green color if value is 0 and red color if value > 0.

Is there any other function I could use for this?

Thanks in advance for your help.

Greets nwe

Re: SingleValue Panel - replace Value with Text

martin_mueller — Thu, 21 Feb 2013 09:28:33 GMT

eval and if or case?

Re: SingleValue Panel - replace Value with Text

nwe — Thu, 21 Feb 2013 09:31:25 GMT

I tried eval this but rangemap function doesnt work anymore because of new field.

... | stats count as errors | rangemap field=errors low=0-0 default=severe | eval status = if(errors = 0, "Service OK", "Service Down") | fields - errors, - range

Re: SingleValue Panel - replace Value with Text

martin_mueller — Thu, 21 Feb 2013 12:58:37 GMT

Rangemap has a hard time doing anything if you strip off the range field afterwards.

Re: SingleValue Panel - replace Value with Text

nwe — Fri, 22 Feb 2013 14:38:36 GMT

I found Solution with eval and Regex...

| stats count as errors | rangemap field=errors low=0-0 default=severe | replace 0 with "Service OK" | eval errors = replace (errors,"[1-9]+","Service NOK")

Thanks for helping.