I want to edit a dashboard table that shows current status of an application. The possible statuses are "Up", "Down", and "Warning". I'd like to display "Up" and "Warning" as a green and yellow checkmark respectively, and "Down" as a red circled "X".
Is this simple to do by editing the XML? The color part can be edited easily in dashboard options so that part is done but substituting the words with symbols is beyond me.
I figure it will go something like:
<format type="something" field="Status Now">
<something type="something">{"Up":#u2713, "Warning":#u2713, "Down":#u29BB} </something>
</format>
Not sure what to put in the "something" fields or if the formatting is correct.
You can do that using CSS and HTML. See "Custom Decorations" in the Splunk Dashboard Examples app.