Dashboard On Off Status

[wuming79]

Hi,

Is there a visual for On/Off Status? Was thinking of showing status of some devices that has been turned on and off on a panel of devices.

[niketn]

@wuming79, if you want to show colors, you will have to print value (or count) as well. If you just want to show icon (without colors - or grey) then you can ignore value/count field. List of icons (font awesome) available with Status Indicator are listed here: http://fontawesome.io/icons/ (latest icons might not be available in Splunk but more daily use icons are present)

  <row>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>| makeresults
| eval status="up"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">150</option>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>| makeresults
| eval status="down"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">150</option>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>      
    </panel>
  </row>

Status Indicator Visualization documentation is available in Splunk Docs: https://docs.splunk.com/Documentation/StatusIndicator/latest/StatusIndicatorViz/StatusIndicatorSearc...

[woodcock]

Check out this blog:

https://www.splunk.com/blog/2015/06/25/shiny-icons/

[somesoni2]

You can use single value visualization to show On/Off string with appropriate colors (green for On and red for Off). Have a look at Splunk 6.x Dashboard Example app (https://splunkbase.splunk.com/app/1603/) for examples of such use-cases.

[niketn]

Status Indicator Custom Visualization similar to Single Value is also an option: https://splunkbase.splunk.com/app/3119/

Whats the query to identify On/Off? Is it Realtime query or based on Heartbeat SLA like last 5 min, 10 min etc.?

[wuming79]

Hi, my query is just to indicate if a device is on/off. Currently I'm using offline data but later will be real time. Is it possible to show the color minus the number?

[wuming79]

I'm doing with static data now but it will be real time later. How do i actually port the indicators to my current dashboard?