Custom Dashboard Help

[sufs2000]

Hello, 

I need some help adding colour to my dashboard. I've got the below block sitting on my high level dashboard view, but I want it to change colour (Red or Green) dependent on the values of the underlying dashboard that it clicks through to which I will share below. 

This is the dashboard it displays below when you click on the above...

Is there some way, that if any of these 5 boxes do not display "OK", then the top level block (EazyBI) will change to Red? Can anyone help me with that?  

[livehybrid]

Hi @sufs2000 

Have a look at the image below, does this help you work out the settings required to have colour dependant on the value?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[sufs2000]

Hi @livehybrid 

Thanks for sharing the below. I see that's how you add colour, but how does that link to the underlying dashboard? If I add the colour to the "EazyBI" block, how would it know to change colour dependent on the values on the underlying dashboard? I'm struggling with making the connection between the top level and the underlying dashboard. 

[livehybrid]

Hi @sufs2000 

I see, sorry I misread the first question. In that case I think you would need to use a search which will determine if either of the lower-level dashboard entities are not "OK" , are you comfortable creating this search?

Ive used the following for the example shown below

| makeresults 
| eval statusesStr="[{\"hostname\": \"host-23\", \"status\": \"OK\"}, {\"hostname\": \"host-87\", \"status\": \"NotOK\"}, {\"hostname\": \"host-45\", \"status\": \"OK\"}]"
| eval statuses=json_array_to_mv(statusesStr)
| mvexpand statuses
| eval _raw=statuses
| fields _raw
| spath
``` end of data setup ```
| eval isBad=IF(status!="OK",1,0)
| stats sum(isBad) as isBad

Ultimately using an IF to determine if its bad (and set value to 1) then sum up the isBad field to get a single value for if there is an issue (>=1)

| eval isBad=IF(status!="OK",1,0)
| stats sum(isBad) as isBad

Once that is done you can apply the same type of logic (see below)

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[sufs2000]

Thanks for the suggestion. I have no idea how to create the search, I am very much a novice when it comes to SPLUNK. So is the search you're suggesting to be applied to the top level block or on the lower level dashboard? I'm not sure where I need to add it? So for example if I add the search on the top level, how does it know to go to the underlying dashboard to retrieve the isBad value? Or is the isBad value stored on the lower level dashboard and the top level is searching for the isBad value on the dashboard?