hi,
I'm used status indicator to show the current status of the field. I had notice when I click on the field it show the count and percentage for the event. How can I simulate the percentage at the field to status indicator dashboard since I had attention when the 100% of Up will turn to UP with green color, when the percent of Up 70% it turn to Warning with color orange and when Up show below 40% it turn to red and Down.
to mimic that data, just use index=indexName|top GroupStatusName
and you'll get the GroupStatusName, count and percent. to color the table, you click on the little paintbrush by the column name and set the rules to look for. see the document below.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/TableFormatsFormatting#Format_table_colum...
to mimic that data, just use index=indexName|top GroupStatusName
and you'll get the GroupStatusName, count and percent. to color the table, you click on the little paintbrush by the column name and set the rules to look for. see the document below.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/TableFormatsFormatting#Format_table_colum...
yeay I can make it...so how if I want just to mimic the percent only where the count table i hide
add |fields - count
to the end of query.