How to use dynamic colors and icons for Status Indicator in Trellis layout?

dzyfer — Wed, 24 Aug 2022 06:17:45 GMT

Hi, how do I display my Status Indicator with dynamic colors and icons in a Trellis layout?

| eval status=case(status_id==0,"Idle", status_id>=1 AND status_id<=3,"Setup/PM", status_id==4,"Idle", status_id>=5 AND status_id<=6,"Down", status_id>=7 AND status_id<=8,"Idle", status_id==9,"Running") | eval color=case(status_id=0,"#edd051", status_id>=1 AND status_id<=3,"#006d9c", status_id=4,"#edd051", status_id>=5 AND status_id<=6,"#ff0000", status_id>=7 AND status_id<=8,"#edd051", status_id=9,"#42dba0") | eval icon=case(status_id=0,"times-circle", status_id>=1 AND status_id<=3,"user", status_id=4,"times-circle", status_id>=5 AND status_id<=6,"warning", status_id>=7 AND status_id<=8,"times-circle", status_id=9,"check") | stats last(status) last(color) last(icon) BY internal_name

This only displays the status with no icons and the default grey color.

Thanks.

topic How to use dynamic colors and icons for Status Indicator in Trellis layout? in Splunk Search

How to use dynamic colors and icons for Status Indicator in Trellis layout?