All Apps and Add-ons

Network Diagram Viz: change single value color (Green/Red) by status (OK/Error)

nathanluke86
Communicator

I have some simple SPL that displays a single value and would like to change the color based on the field value.

index = windows* Status=OK source=computer| dedup source |table host Status

Thanks,

0 Karma
1 Solution

to4kawa
Ultra Champion
index=windows* Status=* source=computer
| dedup source 
| table host Status
| eval color=case(Status=="OK","green",Status=="Error","red")
| eval type="desktop"
| rename host as from
| fields from, type, color

hi, Network Diagram Viz is interesting.
I used it for the first time.
How about this search with Network Diagram Viz?

View solution in original post

to4kawa
Ultra Champion
index=windows* Status=* source=computer
| dedup source 
| table host Status
| eval color=case(Status=="OK","green",Status=="Error","red")
| eval type="desktop"
| rename host as from
| fields from, type, color

hi, Network Diagram Viz is interesting.
I used it for the first time.
How about this search with Network Diagram Viz?

Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...