Dashboards & Visualizations

Custom Dashboard Help

sufs2000
Engager

Hello, 

I need some help adding colour to my dashboard. I've got the below block sitting on my high level dashboard view, but I want it to change colour (Red or Green) dependent on the values of the underlying dashboard that it clicks through to which I will share below. 

sufs2000_3-1741086945524.png

This is the dashboard it displays below when you click on the above...

sufs2000_4-1741087093072.png

Is there some way, that if any of these 5 boxes do not display "OK", then the top level block (EazyBI) will change to Red? Can anyone help me with that?  

 

 

 

Labels (5)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @sufs2000 

Have a look at the image below, does this help you work out the settings required to have colour dependant on the value?

livehybrid_0-1741097365280.png

 

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

0 Karma

sufs2000
Engager

Hi @livehybrid 

Thanks for sharing the below. I see that's how you add colour, but how does that link to the underlying dashboard? If I add the colour to the "EazyBI" block, how would it know to change colour dependent on the values on the underlying dashboard? I'm struggling with making the connection between the top level and the underlying dashboard. 

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @sufs2000 

I see, sorry I misread the first question. In that case I think you would need to use a search which will determine if either of the lower-level dashboard entities are not "OK" , are you comfortable creating this search?

Ive used the following for the example shown below

| makeresults 
| eval statusesStr="[{\"hostname\": \"host-23\", \"status\": \"OK\"}, {\"hostname\": \"host-87\", \"status\": \"NotOK\"}, {\"hostname\": \"host-45\", \"status\": \"OK\"}]"
| eval statuses=json_array_to_mv(statusesStr)
| mvexpand statuses
| eval _raw=statuses
| fields _raw
| spath
``` end of data setup ```
| eval isBad=IF(status!="OK",1,0)
| stats sum(isBad) as isBad

 

Ultimately using an IF to determine if its bad (and set value to 1) then sum up the isBad field to get a single value for if there is an issue (>=1)

| eval isBad=IF(status!="OK",1,0)
| stats sum(isBad) as isBad

Once that is done you can apply the same type of logic (see below)

livehybrid_0-1741177625364.png

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

sufs2000
Engager

Thanks for the suggestion. I have no idea how to create the search, I am very much a novice when it comes to SPLUNK. So is the search you're suggesting to be applied to the top level block or on the lower level dashboard? I'm not sure where I need to add it? So for example if I add the search on the top level, how does it know to go to the underlying dashboard to retrieve the isBad value? Or is the isBad value stored on the lower level dashboard and the top level is searching for the isBad value on the dashboard?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...