Dashboards & Visualizations

Does Splunk have a "Traffic Light"-control for a dashboard?

andyk
Path Finder

I would like to have a couple of controls/reports on my Dashboard that shows the current status of my services. If configurable thresholds are exceeded the control should show red, yellow, green.

Can Splunk do this out of the box?

1 Solution

ftk
Motivator

It does indeed do this out of the box. Take a look at the rangemap command. With it you can define buckets to colorize your events by. You can then use a SingleValue module to display the color. Note the classField parameter; if you are using rangemap to colorize the SingleValue box, set classField to "range" as such:

<option name="classField">range</option>

The pre-defined css classes for SingleValue are none, low, elevated, and severe. So if you want to use the out of the box css use rangemap like in the following example:

evettype=failed_login | stats count | rangemap field=count low=1-5 elevated=5-10 severe=10-9999999 default=None

View solution in original post

jitsinha
Path Finder

is it possible to use it with real time searches??

0 Karma

markthompson
Builder

I would imagine so, all it is is a case of setting a range value, at which the CSS picks it up and transforms it into the traffic light.

Try it and see what comes of it, and let us know! 🙂

0 Karma

jitsinha
Path Finder

No its not working with real time search.
Let say for a low value I have green color on the dashboard, but it should have been yellow once the returned result breaches the threshold. BUt its reflecting the changes only after refreshing the dashboard.

0 Karma

himynamesdave
Contributor

Update: check this demo app complete with examples of how to use traffic lights in Splunk 6.x - https://apps.splunk.com/app/1923/

0 Karma

ftk
Motivator

It does indeed do this out of the box. Take a look at the rangemap command. With it you can define buckets to colorize your events by. You can then use a SingleValue module to display the color. Note the classField parameter; if you are using rangemap to colorize the SingleValue box, set classField to "range" as such:

<option name="classField">range</option>

The pre-defined css classes for SingleValue are none, low, elevated, and severe. So if you want to use the out of the box css use rangemap like in the following example:

evettype=failed_login | stats count | rangemap field=count low=1-5 elevated=5-10 severe=10-9999999 default=None

lguinn2
Legend

You can also use Simple XML to specify the classField option.

andyk
Path Finder

Found it, problem solved. Works great!

0 Karma

ftk
Motivator

You specify it as an option to the SingleValue module in your advanced dashboard XML. Check out the following doc topic for an intro to advanced XML: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedIntro

0 Karma

andyk
Path Finder

Where do I set "range"? Should I edit a file or is it done through the webgui?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...