Hi, everyone!
I am trying to display green/red buttons when a condition returns 0 or 1.
My query is:
index="myindex" sourcetype="mysource" | eval value=if(maild="running","1","0") | stats count by value | fields value | rangemap field=value up=1-1 down=0-0 none=2-2 default=none
Depends on my maild daemon data indexed, it returns value=1 | range=up or value=0 | range=down and works very well.
To show a nice button, i'm using this css:
.custom-result-value {
font-size: 55px;
margin: 35px auto;
text-align: center;
font-weight: bold;
color: rgb(85, 85, 85);
}
.custom-result-value:before {
font-family: "Splunk Icons";
font-style: normal;
font-weight: normal;
text-decoration: inherit;
font-size: 110%;
}
.down.custom-result-value:before {
content: "\2297";
}
.down.custom-result-value {
color: rgb(217, 63, 60);
}
.up.custom-result-value {
color: rgb(101, 166, 55);
}
.up.custom-result-value:before {
content: "\ECD3";
}
.custom-result-value.icon-only {
font-size: 90px;
}
And finally the dashboard:
<dashboard stylesheet="custom_decorations.css">
<label>temp</label>
<description>
This example shows decorations using tokens from search results, HTML panels and some custom CSS. The icon are displayed using the Splunk Icon Font.
</description>
<row>
<panel>
<search>
<query>
index="myindex" sourcetype="mysource" | eval value=if(maild="running","1","0") | stats count by value | fields value | rangemap field=value up=1-1 down=0-0 none=2-2 default=none
</query>
<progress>
<set token="value1">$result.value$</set>
<set token="range1">$result.range$</set>
</progress>
</search>
<html>
<div class="custom-result-value $range1$">
$value1$
</div>
</html>
</panel>
....
But doesn't work. The dashboard shows the red button when the value=1. I double checked in other search window and the query returns value=1 | range=up. Why inside my dashboard data doesn't look as desired?
Thanks!
