All Apps and Add-ons

Network Diagram Viz: change single value color (Green/Red) by status (OK/Error)

nathanluke86
Communicator

I have some simple SPL that displays a single value and would like to change the color based on the field value.

index = windows* Status=OK source=computer| dedup source |table host Status

Thanks,

0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
index=windows* Status=* source=computer
| dedup source 
| table host Status
| eval color=case(Status=="OK","green",Status=="Error","red")
| eval type="desktop"
| rename host as from
| fields from, type, color

hi, Network Diagram Viz is interesting.
I used it for the first time.
How about this search with Network Diagram Viz?

View solution in original post

to4kawa
SplunkTrust
SplunkTrust
index=windows* Status=* source=computer
| dedup source 
| table host Status
| eval color=case(Status=="OK","green",Status=="Error","red")
| eval type="desktop"
| rename host as from
| fields from, type, color

hi, Network Diagram Viz is interesting.
I used it for the first time.
How about this search with Network Diagram Viz?

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!