Archive

Dashboard On Off Status

Path Finder

Hi,

Is there a visual for On/Off Status? Was thinking of showing status of some devices that has been turned on and off on a panel of devices.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

@wuming79, if you want to show colors, you will have to print value (or count) as well. If you just want to show icon (without colors - or grey) then you can ignore value/count field. List of icons (font awesome) available with Status Indicator are listed here: http://fontawesome.io/icons/ (latest icons might not be available in Splunk but more daily use icons are present)

  <row>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>| makeresults
| eval status="up"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">150</option>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>| makeresults
| eval status="down"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">150</option>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>      
    </panel>
  </row>

Status Indicator Visualization documentation is available in Splunk Docs: https://docs.splunk.com/Documentation/StatusIndicator/latest/StatusIndicatorViz/StatusIndicatorSearc...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Esteemed Legend
0 Karma

SplunkTrust
SplunkTrust

You can use single value visualization to show On/Off string with appropriate colors (green for On and red for Off). Have a look at Splunk 6.x Dashboard Example app (https://splunkbase.splunk.com/app/1603/) for examples of such use-cases.

0 Karma

SplunkTrust
SplunkTrust

Status Indicator Custom Visualization similar to Single Value is also an option: https://splunkbase.splunk.com/app/3119/

Whats the query to identify On/Off? Is it Realtime query or based on Heartbeat SLA like last 5 min, 10 min etc.?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

Hi, my query is just to indicate if a device is on/off. Currently I'm using offline data but later will be real time. Is it possible to show the color minus the number?

0 Karma

Path Finder

I'm doing with static data now but it will be real time later. How do i actually port the indicators to my current dashboard?

0 Karma