Status Indicator - Custom Visualization: Why is "Icon Only" view not working as expected?

[david_rose]

I have the following search I am using to create some status indicator visualizations:

... | rangemap field=delta #ff0000=-1000-0 #008000=0-10000 default=#ff0000 | rename range as range_color | eval icon="check-circle" | table delta icon range_color

This works as expected if I use "Show Value and Icon":

If I use "Show Icon Only", i get the following error:

Error rendering Status Indicator visualization: The specified icon does not exist. Check the font awesome website to find a valid icon. Examples: arrow-circle-left, bullseye, mobile

[aaraneta_splunk]

@david.rose - Did the answer provided by nickhillscpl help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[nickhills · Accepted solution]

try:

basesearch | table  icon range_color delta

I found this too - the order of the fields is relevent when not using both the value and the icon, yet it still insists on providing all 3 fields.

[harry521]

Thanks nickhillscpl. "Order" does matter! In my case, I have to put the ragemap field to the middle. Never thought of that!

[woodcock]

So did this fix it for you? If so, please do click Accept to close the question and help others.

[harry521]

I encounter the exact same problem. But if picked icon "Static icon", it worked. Not working when choosing "Field value". Anyone has any thoughts?