All Apps and Add-ons

Status Indicator App: Why are Sort and Color not showing in dashboard?

mawomommoh
Path Finder

I am making use of the Status Indicator App to create a dashboard which shows if steps in a process Passed, Skipped or Failed. I get my events from an xml file and I have been able to create the dashboard successfully with each step in the xml being reflected in the dashboard with their corresponding StepResult.

I am trying to sort the order of events showing in the dashboard based on the timestamp gotten from each step in the xml. Using my search query, the events are sorted properly when viewed in the Events and Statistics tab, but when I use the same search query in the Status Indicator App for my dashboard, the events become ordered alphabetically instead of using the timestamp I have extracted (StartTime). Any idea why the sort stops working when I insert the same search query in the Status Indicator App dashboard?

Here is my search query:

host=XXXX index=XXXX
| eval NewTime=strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N") | eval _time=NewTime 
  | eventstats max(_time) AS lastestScan by Description 
  | where _time=lastestScan | stats count by StepResult, Description, _time| sort _time | eval color=case(StepResult=="Passed","green",StepResult=="Skipped","gold", StepResult=="Failed","red")
  | eval StepResult = Description

Also, the colors for each step no longer show, but when I get rid of the _ time field in the stats command, the colors work again.

Any assistance would be appreciated.

Thanks in advance.

0 Karma

pgadhari
Builder

@mawomommoh - I am also facing the same problem, were you able to resolve this issue ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...