Dashboards & Visualizations
Highlighted

Does Splunk have a "Traffic Light"-control for a dashboard?

Path Finder

I would like to have a couple of controls/reports on my Dashboard that shows the current status of my services. If configurable thresholds are exceeded the control should show red, yellow, green.

Can Splunk do this out of the box?

Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Motivator

It does indeed do this out of the box. Take a look at the rangemap command. With it you can define buckets to colorize your events by. You can then use a SingleValue module to display the color. Note the classField parameter; if you are using rangemap to colorize the SingleValue box, set classField to "range" as such:

<option name="classField">range</option>

The pre-defined css classes for SingleValue are none, low, elevated, and severe. So if you want to use the out of the box css use rangemap like in the following example:

evettype=failed_login | stats count | rangemap field=count low=1-5 elevated=5-10 severe=10-9999999 default=None

View solution in original post

Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Path Finder

Where do I set "range"? Should I edit a file or is it done through the webgui?

0 Karma
Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Motivator

You specify it as an option to the SingleValue module in your advanced dashboard XML. Check out the following doc topic for an intro to advanced XML: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedIntro

0 Karma
Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Path Finder

Found it, problem solved. Works great!

0 Karma
Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Legend

You can also use Simple XML to specify the classField option.

Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Contributor

Update: check this demo app complete with examples of how to use traffic lights in Splunk 6.x - https://apps.splunk.com/app/1923/

0 Karma
Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Path Finder

is it possible to use it with real time searches??

0 Karma
Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Builder

I would imagine so, all it is is a case of setting a range value, at which the CSS picks it up and transforms it into the traffic light.

Try it and see what comes of it, and let us know! 🙂

0 Karma
Highlighted

Re: Does Splunk have a "Traffic Light"-control for a dashboard?

Path Finder

No its not working with real time search.
Let say for a low value I have green color on the dashboard, but it should have been yellow once the returned result breaches the threshold. BUt its reflecting the changes only after refreshing the dashboard.

0 Karma