All Apps and Add-ons

Network Diagram Viz: change single value color (Green/Red) by status (OK/Error)

nathanluke86
Communicator

I have some simple SPL that displays a single value and would like to change the color based on the field value.

index = windows* Status=OK source=computer| dedup source |table host Status

Thanks,

0 Karma
1 Solution

to4kawa
Ultra Champion
index=windows* Status=* source=computer
| dedup source 
| table host Status
| eval color=case(Status=="OK","green",Status=="Error","red")
| eval type="desktop"
| rename host as from
| fields from, type, color

hi, Network Diagram Viz is interesting.
I used it for the first time.
How about this search with Network Diagram Viz?

View solution in original post

to4kawa
Ultra Champion
index=windows* Status=* source=computer
| dedup source 
| table host Status
| eval color=case(Status=="OK","green",Status=="Error","red")
| eval type="desktop"
| rename host as from
| fields from, type, color

hi, Network Diagram Viz is interesting.
I used it for the first time.
How about this search with Network Diagram Viz?

Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...