Splunk ITSI

IT Service Intelligence: How to change the color based on the value of a field (state)?

DataOrg
Builder

Below is the data I have in search time. I have the entity as a state column.
How can I make running as Green and Stopped as Red ?

ServiceType="Own Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=20088
0 Karma
1 Solution

adonio
Ultra Champion

if you are asking regarding a KPI, i would probably convert the value of State field to a number
for example:
... your search ... | eval status=if(State''"Running",0,1) ...
then on the KPI i will have the max function and the field to report as status
when defining thresholds, normal will be 0 and High or Critical will be 1

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

if you are asking regarding a KPI, i would probably convert the value of State field to a number
for example:
... your search ... | eval status=if(State''"Running",0,1) ...
then on the KPI i will have the max function and the field to report as status
when defining thresholds, normal will be 0 and High or Critical will be 1

hope it helps

0 Karma

DataOrg
Builder

but in the KPI tile. the status will be shown as numeric value as 1 or 0. it there any way i can display the state and to calculate i can use status value?

0 Karma

adonio
Ultra Champion

ITSI KPIs working only on numeric values, you cant put a string (per-se) in the visualization as far as i know
meaning, you cant have a text in the KPI viz box

Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...