- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
I'm currently using Splunk Cloud and my focus is to display status icons as values based on the search results in my classic dashboard table. I found a way to display only the icon with html but at the same time im struggling to assign the icon based on the result from the search query (if result active, pass icon check-circle else default pass icon warning/error etc.). How can I achieve this ? Any tweaks from this code attached will be much appreciated!
<row>
<html>
<div>
<td class="icon-inline numeric">
<i>Range icon: </i>
<i class="icon-check-circle" style="color: green"><var>low</var></i>
<i class="icon-alert" style="color: orange">warning</i>
<i class="icon-alert-circle" style="color: red">error</i>
</td>
</div>
</html>
</row>
<row>
<panel>
<table id="t1">
<search>
<query>index=XXX host=* | eval host=upper(host)
| stats count BY host
| eval count=1, host=upper(host) | fields host count
| stats sum(count) AS total BY host|rangemap field=total low=1-10 default=severe</query>
<earliest>-30m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh, okay. In that case you dont have to use the viz addon . Instead splunk supports emojis that you can use in your search.
<base search>
| eval status=case(range="inactive","❌",range="active","✅")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would recommend to use Status Indicator - Custom Visualization | Splunkbase
One simple example to use it:
<panel>
<title>Status Indicator Demo</title>
<viz type="status_indicator_app.status_indicator">
<search>
<query>index=_internal sourcetype=splunkd_ui_access
| rangemap field=status green=200-399 red=400-9999 default=red
| eval icon=case(range="red","exclamation-circle",range="green","check")
| eval color=case(range="red","#b93622",range="green","#29bd23")
| table status icon color</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">2</option>
<option name="status_indicator_app.status_indicator.staticColor">#53a051</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your reply. I've give a try and the icons appear but how to make it include align with the list result?
expected result:
host | range | status
xxx1 active (green icon)
xxx2 inactive (red icon)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh, okay. In that case you dont have to use the viz addon . Instead splunk supports emojis that you can use in your search.
<base search>
| eval status=case(range="inactive","❌",range="active","✅")
