Dashboards & Visualizations

How to get a panel to display a single value of Yes(Green)/No(red) or True(Green)/False(Red) based on the search result?

agoktas
Communicator

Hello,

I have a log entry that will display: Processor being destroyed

And when it does (within my real-time search (all time)), I want to display Yes (Green) in a dashboard panel.

When it has not yet occurred, I want the dashboard panel to display No (Red).

If yes/no is not possible and True/False is, then that is ok too. 🙂

Thanks!

0 Karma

muebel
SplunkTrust
SplunkTrust

Sounds like you might want to check out using rangemap with a single value panel : http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Rangemap#Using_rangemap_with_singl...

0 Karma

somesoni2
Revered Legend

Look at the SPlunk 6.x dashboard example app (link below) and look at the examples for Single value. You'll find similar/better options to achieve the same.

https://splunkbase.splunk.com/app/1603/

0 Karma

agoktas
Communicator

Unfortunately we're only on 6.2, so we have some limitations with single values.

Does anyone have any examples they have setup pre 6.3?

0 Karma

somesoni2
Revered Legend

The above app does work for 6.2.

If you just want to display Yes/No for value in the single value panel, you can have your search like this (sample)

your base search "Processor being destroyed" | head 1 | stats count | eval result=if(count=1,"True","False") | table result

0 Karma

agoktas
Communicator

That's perfect! Thanks for that.

Would you happen to know how to make the text on "True" green & the text color on "False" red?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!