Solved: How to add icon in Splunk Cloud?

aa0 · ‎01-12-2023

Hi all,

I'm currently using Splunk Cloud and my focus is to display status icons as values based on the search results in my classic dashboard table. I found a way to display only the icon with html but at the same time im struggling to assign the icon based on the result from the search query (if result active, pass icon check-circle else default pass icon warning/error etc.). How can I achieve this ? Any tweaks from this code attached will be much appreciated!

<row>
<html>
<div>
<td class="icon-inline numeric">
<i>Range icon: </i>
<i class="icon-check-circle" style="color: green"><var>low</var></i>
<i class="icon-alert" style="color: orange">warning</i>
<i class="icon-alert-circle" style="color: red">error</i>
</td>
</div>
</html>
</row>

<row>
<panel>
<table id="t1">
<search>
<query>index=XXX host=* | eval host=upper(host)
| stats count BY host
| eval count=1, host=upper(host) | fields host count
| stats sum(count) AS total BY host|rangemap field=total low=1-10 default=severe</query>
<earliest>-30m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>

</table>

</panel>
</row>

PaulPanther · ‎01-13-2023

Ahh, okay. In that case you dont have to use the viz addon . Instead splunk supports emojis that you can use in your search.

<base search>
| eval status=case(range="inactive","❌",range="active","✅")

View solution in original post

PaulPanther · ‎01-12-2023

I would recommend to use Status Indicator - Custom Visualization | Splunkbase

One simple example to use it:

    <panel>
      <title>Status Indicator Demo</title>
      <viz type="status_indicator_app.status_indicator">
        <search>
          <query>index=_internal sourcetype=splunkd_ui_access
| rangemap field=status green=200-399 red=400-9999 default=red 
| eval icon=case(range="red","exclamation-circle",range="green","check") 
| eval color=case(range="red","#b93622",range="green","#29bd23") 
| table status icon color</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">background</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">2</option>
        <option name="status_indicator_app.status_indicator.staticColor">#53a051</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>

aa0 · ‎01-13-2023

Thanks for your reply. I've give a try and the icons appear but how to make it include align with the list result?

expected result:

host | range | status

xxx1 active (green icon)

xxx2 inactive (red icon)

PaulPanther · ‎01-13-2023

Ahh, okay. In that case you dont have to use the viz addon . Instead splunk supports emojis that you can use in your search.

<base search>
| eval status=case(range="inactive","❌",range="active","✅")

How to add icon in Splunk Cloud?

dashboard

other

table

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases