topic Re: How to display a table icon for a certain process status? in Splunk Search

How to display a table icon for a certain process status?

proylea — Mon, 31 Aug 2015 02:43:52 GMT

I would like to show a list of processes and use the table icon set to show the status of the process, either existing (running) or not:
Green Tick for existing and Red Cross for not.

I can understand how to show a running process with a green tick next to it, but how do you show a non existing process with a red cross next to it? I'm assuming I would need to compare what was or should be existing with what is currently running.

An example of how to do this would be greatly appreciated.

Kind Regards
Peter

Re: How to display a table icon for a certain process status?

MuS — Mon, 31 Aug 2015 03:06:57 GMT

Hi proylea,

you would need a lookup to keep track of the expected processes and use this lookup as comparison to the search.
Take a look at this answer http://answers.splunk.com/answers/73268/search-for-hosts-in-a-lookup-but-not-in-splunk.html to get an idea how it can be done; this was done to get hosts from a lookup which do not show in a search.

Hope this helps ....

cheers, MuS

Re: How to display a table icon for a certain process status?

proylea — Mon, 31 Aug 2015 23:54:54 GMT

Thanks that's exactly what I was looking for