Solved: Problem with custom decorations and dashboards

changux · ‎07-27-2017

Hi, everyone!

I am trying to display green/red buttons when a condition returns 0 or 1.

My query is:

index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | stats count by value  | fields value | rangemap field=value  up=1-1 down=0-0 none=2-2 default=none

Depends on my maild daemon data indexed, it returns value=1 | range=up or value=0 | range=down and works very well.

To show a nice button, i'm using this css:

.custom-result-value {
    font-size: 55px;
    margin: 35px auto;
    text-align: center;
    font-weight: bold;
    color: rgb(85, 85, 85);
}
.custom-result-value:before {
    font-family: "Splunk Icons";
    font-style: normal;
    font-weight: normal;
    text-decoration: inherit;
    font-size: 110%;
}
.down.custom-result-value:before {
    content: "\2297";
}
.down.custom-result-value {
    color: rgb(217, 63, 60);
}
.up.custom-result-value {
    color: rgb(101, 166, 55);
}
.up.custom-result-value:before {
    content: "\ECD3";
}
.custom-result-value.icon-only {
    font-size: 90px;
}

And finally the dashboard:

<dashboard stylesheet="custom_decorations.css">
    <label>temp</label>
    <description>
        This example shows decorations using tokens from search results, HTML panels and some custom CSS. The icon are displayed using the Splunk Icon Font.
    </description>
    <row>
        <panel>
            <search>
                <query>
                index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | stats count by value  | fields value | rangemap field=value  up=1-1 down=0-0 none=2-2 default=none
                </query>
                <progress>
                    <set token="value1">$result.value$</set>
                    <set token="range1">$result.range$</set>
                </progress>
            </search>
            <html>
                <div class="custom-result-value $range1$">
                    $value1$ 
                </div>
            </html>
        </panel>
....

But doesn't work. The dashboard shows the red button when the value=1. I double checked in other search window and the query returns value=1 | range=up. Why inside my dashboard data doesn't look as desired?

Thanks!

changux · ‎07-27-2017

I changed my query by:

index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none

And works!!!!

View solution in original post

changux · ‎07-27-2017

I changed my query by:

index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none

And works!!!!

Problem with custom decorations and dashboards

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation