Hi,
Is there a visual for On/Off Status? Was thinking of showing status of some devices that has been turned on and off on a panel of devices.
@wuming79, if you want to show colors, you will have to print value (or count) as well. If you just want to show icon (without colors - or grey) then you can ignore value/count field. List of icons (font awesome) available with Status Indicator are listed here: http://fontawesome.io/icons/ (latest icons might not be available in Splunk but more daily use icons are present)
<row>
<panel>
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| eval status="up"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="height">150</option>
<option name="drilldown">none</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
<panel>
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| eval status="down"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="height">150</option>
<option name="drilldown">none</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
Status Indicator Visualization documentation is available in Splunk Docs: https://docs.splunk.com/Documentation/StatusIndicator/latest/StatusIndicatorViz/StatusIndicatorSearc...
Check out this blog:
You can use single value visualization to show On/Off string with appropriate colors (green for On and red for Off). Have a look at Splunk 6.x Dashboard Example app (https://splunkbase.splunk.com/app/1603/) for examples of such use-cases.
Status Indicator Custom Visualization similar to Single Value is also an option: https://splunkbase.splunk.com/app/3119/
Whats the query to identify On/Off? Is it Realtime query or based on Heartbeat SLA like last 5 min, 10 min etc.?
Hi, my query is just to indicate if a device is on/off. Currently I'm using offline data but later will be real time. Is it possible to show the color minus the number?
I'm doing with static data now but it will be real time later. How do i actually port the indicators to my current dashboard?