Quick State - use local image

[season88481]

Hi any one have experience of this app.

Our Splunk server doesn't have access to Internet. Could we use the image in our local directory?

I tried something like this: (my search table)|eval img="/opt/splunk/etc/apps/test/bin/Floppy-Disk-128.png" | eval state = case(warning_level == "OKAY","DarkOliveGreen", warning_level == "WARNING","FireBrick") | table host img state

It could not display my image.

Any thoughts?

Thanks a lot.

Cheers,
Vincent

[rcheeks · Accepted solution]

Check out this post - https://answers.splunk.com/answers/287949/what-path-do-i-use-to-add-new-files-images-and-fon.html

The answer applies to Quick State as well. Just make sure any image you want to use exists in:
/opt/splunk/etc/apps/quick_state_app/appserver/static

For example. to use the file preview.png, use this eval statement:
eval img="/static/app/quick_state_app/preview.png"

[Lucas_K]

Your example path would not work because that is a literal file path and not a URL path (the path a browser can use to get the file).

A valid url option might be something like "/en-US/splunkd/__raw/servicesNS/nobody/search/static/appIconAlt.png"

You'd need to find the end point for custom icons contained within an app. Upload your own custom icons to your apps static directory.

Then reference it something similar to /en-US/splunkd/__raw/servicesNS/nobody/myapp/static/appLogo.png

I pulled that from using an inspect in my browser so I'd guess someone might know of the better services endpoint url that you can use instead of servicesNS.