Dashboards & Visualizations

Question about search

nebel
Communicator

Hi,

I built a search like this

sourcetype=firewall rule=100 | search drop OR accept | head 1

This shows my only the last event (drop or accept).

Now I want to visualize with a colored single value field. For "drop" it should going red, for accept it should going green.

How can I realize that?

Thank you very much!

Regards

Tags (3)
0 Karma
1 Solution

Drainy
Champion

Further to Ayns answer, you don't need to do a | search after your searchterms, they are all search terms. Just do a sourcetype=firewall rule=100 drop OR accept | head etc

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...