Dashboards & Visualizations

Using Text Field ("Up", "Down") for Single Value in Dashboard and Changing Colors

Builder

I am trying to use a field in my log (status) that either says "Up" or "Down". I have to convert this into a number for the rangemap command:

      <single>
      <title>Network Monitoring - Jabber</title>
      <option name="classField">range</option>
      <option name="field">status</option>    
      <searchTemplate>host=hostname sourcetype="sourcetype" | head 1 | eval alert_level = case(status=="up",1,status=="down",2) | rangemap field=alert_level green=0-0 red=1-2


(For some reason the ending /searchtemplate and /single tags are missing when I paste them into this question form.)

I cannot get this work. I also want to word "Up" or "Down" to either be green or red, respectively.

Any help would be appreciated, and thank you!

1 Solution

Legend

I think the main thing is that there is no tag "searchTemplate" in a simple XML dashboard panel. It's "searchString." Also, you didn't have your ranges set properly.

 <single>
      <title>Network Monitoring - Jabber</title>
      <option name="classField">range</option>
      <option name="field">status</option>    
      <searchString>host=hostname sourcetype="sourcetype" | head 1 | eval alert_level =   
              case(status=="up",1,status=="down",2) | rangemap field=alert_level low=1-1 severe=2-2
       </searchString>
</single>

View solution in original post

Legend

I think the main thing is that there is no tag "searchTemplate" in a simple XML dashboard panel. It's "searchString." Also, you didn't have your ranges set properly.

 <single>
      <title>Network Monitoring - Jabber</title>
      <option name="classField">range</option>
      <option name="field">status</option>    
      <searchString>host=hostname sourcetype="sourcetype" | head 1 | eval alert_level =   
              case(status=="up",1,status=="down",2) | rangemap field=alert_level low=1-1 severe=2-2
       </searchString>
</single>

View solution in original post

Builder

Thank you!!

0 Karma

Path Finder

Nice! I was searching for this a long long time.

If you try to simulate this on "Search" it won't work. This feature works only on views/dashboards.

For understand this berravior I test it using the following generic search:

<single>
  <title>Network Monitoring - Jabber</title>
  <option name="classField">range</option>
  <option name="field">status</option>    
  <searchString>index=* | head 1 | eval status="up" | head 1 | eval alert_level =   
    case(status=="up",1,status=="down",2) | rangemap field=alert_level low=1-1 severe=2-2
  </searchString>
</single>
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!