Dashboards & Visualizations

Does anyone have sample XML code to show color coded alert statuses based on a specific count in a dashboard panel?


Hi ,

Can any one please share me a sample code(xml) to show the alert status based on a specific count in Dashboard Panel?

If count is >100 then i need to show RED as a status.

If count >70 then i need to show YELLOW

If count <50 then its green

0 Karma

Revered Legend

Something like this??

          <query>index=_internal ERROR | stats count by sourcetype | eval Status=case(count&gt;100,"RED", count&gt;70,"YELLOW", count&lt;50,"GREEN",1=1,"BROWN")</query>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
0 Karma


Hi @Somesoni2, thanks for your reply. But in my case I need to hide count and source type details in front. Just for One value[which should run in background] and I need to show the color alone in front end. Like text as GREEN,RED[or X symbol] ,YELLOW

Please see the attachment:


0 Karma

Splunk Employee
Splunk Employee

Also check out the following app if you want to perform any table customization based on this status field (cell highlighting, row highlighting, icon sets, etc).

Splunk 6.x Dashboard Examples

0 Karma


thnx for your reply

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!