I know that I can have some single values over an image, as follows:
(example from Dashboards for Splunk 6.X).
However I need to display an icon based on values, instead of displying a single value.
For example, if my search returns 1, I should display an OK icon, if it returns any other value, it should display an Error icon, something like this:
Have anyone done this yet?
Is it possible?
I'm running a cluster environment with Splunk 6.3.2.
Thanks in advance!
Please find below changes to Simple XML Examples - Image Overlay with Single Values example, which will allow you to display dynamic images instead of values. As a pre-requisite, you should remove the boxes from splunkindexingpipeline.png to display icons dynamically instead and place it back under the same folder. Also create redexclaim.png and greencheck.png images and place them under your Splunk App's appserver\static folder i.e. same as the splunkindexingpipeline.png overlay image folder.
Since job.resultCount will allow you to set conditional tokens, change your Search to either return results(green) or no results(red). Within the search query define the following condition blocks in Search Preview :
<preview> <condition match="'job.resultCount'==0"> <set token="parsing_queue_icon">red_exclaim</set> </condition> <condition match="'job.resultCount'>0"> <set token="parsing_queue_icon">green_check</set> </condition> </preview>
In the HTML Panel code i.e. inside <html> tag, after image is included add the following <img> tag to display dynamic red exclamation or green check icon.
<html> <div class="ingestion_pipeline"> <div class="image"></div> <div class="singleValue" id="parsing_queue"><img src="/static/app/simple_xml_examples/$parsing_queue_icon$.png"/></div> <!--similarly for other blocks --> <!--similarly for other blocks --> <!--similarly for other blocks --> </div> </html>
Please let me know if this does not work or further detail is required.
In this example, job.resultCount count the number of results, right?
Not the value?
My result is QTD=1. In this case, I want to show the greencheck icon
If the result is QTD =2, I need to show the redexclaim.
Ho to achieve that?
If you want to use job.resultCount you can change the search query to perform
| search=QTD=1 in the end. That way job.resultCount will be >0 only when QTD is one. But this implies you need to have one base search with several post process queries like QTD=1, QTD=2. Which is not feasible for most scenarios and is a performance bottleneck.
This was the problem I was actually working on and solved myself. Please refer to the following answer thread and vote if it works for you as well. HINT : I used eval to match to set tokens instead of condition. However, job.resultCount will still be required becase eval will not work when there are no results and default values would still need to be set.