Does anyone have sample XML code to show color coded alert statuses based on a specific count in a dashboard panel?

[Bhuavana]

Hi ,

Can any one please share me a sample code(xml) to show the alert status based on a specific count in Dashboard Panel?

If count is >100 then i need to show RED as a status.

If count >70 then i need to show YELLOW

If count <50 then its green

[somesoni2]

Something like this??

<dashboard>
  <label>OverallHealthStatus</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal ERROR | stats count by sourcetype | eval Status=case(count&gt;100,"RED", count&gt;70,"YELLOW", count&lt;50,"GREEN",1=1,"BROWN")</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
</dashboard>

[Bhuavana]

Hi @Somesoni2, thanks for your reply. But in my case I need to hide count and source type details in front. Just for One value[which should run in background] and I need to show the color alone in front end. Like text as GREEN,RED[or X symbol] ,YELLOW

Please see the attachment:

http://C:\Users\149763\Desktop\Alert+status.jpg

[nfilippi_splunk]

Also check out the following app if you want to perform any table customization based on this status field (cell highlighting, row highlighting, icon sets, etc).

Splunk 6.x Dashboard Examples
https://apps.splunk.com/app/1603/

[Bhuavana]

thnx for your reply