I have a search that checks to see if a process particular process is running. Simple enough.
In my dashboard, I want users to be able to see if that process is running. But rather than displaying the process, I'd like to use a "" to simply say "Yes" or "No".
I know Splunk can count the number of results, but is there a way to tell the dashboard to display "Yes" if count>0 and "No" if count==0?
Thanks!
There are a few options, but a simple way is to use eval
to pull out a new field.
Try this:
... | eval yesno=if(count==0, "No", "Yes")
The docs page for eval
has some other examples:
http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Eval
To use it in your XML, you might do something like this:
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">YOUR TERMS HERE | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low</param>
<module name="SingleValue">
<param name="field">yesno</param>
<param name="classField">range</param>
</module>
</module>
I had to change
The N/A sounds like you have a SingleValue module that's looking at the wrong field. See edits to answer above.
Actually I figured out the mis-matched tag issue... but it's still not providing the expected behavior. It's reporting "N/A". But I think you've pointed me in the right direction. I'll try to figure it out from here. Thanks!
Thanks for the reply.
Unfortunately, this doesn't seem to work in the context of a dashboard. I keep getting a "mismatched tag:" error when I had the eval statement. The same thing happens when I use a regex. In the search bar it's fine, but not in an XML file...