All Apps and Add-ons

Quick State - use local image


Hi any one have experience of this app.

Our Splunk server doesn't have access to Internet. Could we use the image in our local directory?

I tried something like this: (my search table)|eval img="/opt/splunk/etc/apps/test/bin/Floppy-Disk-128.png" | eval state = case(warninglevel == "OKAY","DarkOliveGreen", warninglevel == "WARNING","FireBrick") | table host img state

It could not display my image.

Any thoughts?

Thanks a lot.


0 Karma

Re: Quick State - use local image


Your example path would not work because that is a literal file path and not a URL path (the path a browser can use to get the file).

A valid url option might be something like "/en-US/splunkd/__raw/servicesNS/nobody/search/static/appIconAlt.png"

You'd need to find the end point for custom icons contained within an app. Upload your own custom icons to your apps static directory.

Then reference it something similar to /en-US/splunkd/__raw/servicesNS/nobody/myapp/static/appLogo.png

I pulled that from using an inspect in my browser so I'd guess someone might know of the better services endpoint url that you can use instead of servicesNS.

0 Karma

Re: Quick State - use local image


Check out this post -

The answer applies to Quick State as well. Just make sure any image you want to use exists in:

For example. to use the file preview.png, use this eval statement:
eval img="/static/app/quickstateapp/preview.png"

View solution in original post