Dashboards & Visualizations

Dashboard On Off Status

wuming79
Path Finder

Hi,

Is there a visual for On/Off Status? Was thinking of showing status of some devices that has been turned on and off on a panel of devices.

Tags (1)
0 Karma

niketn
Legend

@wuming79, if you want to show colors, you will have to print value (or count) as well. If you just want to show icon (without colors - or grey) then you can ignore value/count field. List of icons (font awesome) available with Status Indicator are listed here: http://fontawesome.io/icons/ (latest icons might not be available in Splunk but more daily use icons are present)

  <row>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>| makeresults
| eval status="up"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">150</option>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>| makeresults
| eval status="down"
| eval icon=case(status=="up","check-circle",status=="down","times-circle")
| eval color=case(status=="up","#00FF00",status=="down","#ff0000")
| table status icon color</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">150</option>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>      
    </panel>
  </row>

Status Indicator Visualization documentation is available in Splunk Docs: https://docs.splunk.com/Documentation/StatusIndicator/latest/StatusIndicatorViz/StatusIndicatorSearc...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use single value visualization to show On/Off string with appropriate colors (green for On and red for Off). Have a look at Splunk 6.x Dashboard Example app (https://splunkbase.splunk.com/app/1603/) for examples of such use-cases.

0 Karma

niketn
Legend

Status Indicator Custom Visualization similar to Single Value is also an option: https://splunkbase.splunk.com/app/3119/

Whats the query to identify On/Off? Is it Realtime query or based on Heartbeat SLA like last 5 min, 10 min etc.?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

wuming79
Path Finder

Hi, my query is just to indicate if a device is on/off. Currently I'm using offline data but later will be real time. Is it possible to show the color minus the number?

0 Karma

wuming79
Path Finder

I'm doing with static data now but it will be real time later. How do i actually port the indicators to my current dashboard?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...