I have a search that checks to see if a process particular process is running. Simple enough.
In my dashboard, I want users to be able to see if that process is running. But rather than displaying the process, I'd like to use a "" to simply say "Yes" or "No".
I know Splunk can count the number of results, but is there a way to tell the dashboard to display "Yes" if count>0 and "No" if count==0?
There are a few options, but a simple way is to use
eval to pull out a new field.
... | eval yesno=if(count==0, "No", "Yes")
The docs page for
eval has some other examples:
To use it in your XML, you might do something like this:
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search">YOUR TERMS HERE | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low</param> <module name="SingleValue"> <param name="field">yesno</param> <param name="classField">range</param> </module> </module>
Actually I figured out the mis-matched tag issue... but it's still not providing the expected behavior. It's reporting "N/A". But I think you've pointed me in the right direction. I'll try to figure it out from here. Thanks!
Thanks for the reply.
Unfortunately, this doesn't seem to work in the context of a dashboard. I keep getting a "mismatched tag:" error when I had the eval statement. The same thing happens when I use a regex. In the search bar it's fine, but not in an XML file...