How to Edit my search Query to Show images in the Dashboard panel?

[kiran331]

Hello

How to add the images in Splunk Dashboard panel, I have to show a 'Tick' mark when I see logs from a Index and 'X' mark if i'm not receiving logs n last 24 hours

like

cisco_asa cisco_wsa wineventlog
X X X

Query I'm using :
(index=cisco_asa OR index=lenel OR (index=wineventlog) OR index=rsa OR index=lenel OR index=cisco_wsa OR index=cisco_esa OR index=mcafee OR index=esteamer )|dedup index|eval status="Logs Reveived"

[somesoni2 · Accepted solution]

For the visualization part, download Splunk 6.x Dashboard example app from Splunk base. You need to specifically look for 'Table Icon Set (Range map)' example under 'Table Elements'. This will require setting up some java script and css file.

You can use below search with above example dashboard to show an icon based on logs receive timestamp on the index (and faster too).

| tstats max(_time) as lastSeen WHERE (index=cisco_asa OR index=lenel OR (index=wineventlog) OR index=rsa OR index=lenel OR index=cisco_wsa OR index=cisco_esa OR index=mcafee OR index=esteamer ) earliest=-3d@d by index | eval range=if(now()-lastSeen>86400,"severe","low") | table index range

[kiran331]

Thank you. Is there a way to export it to PDF with icons in it, When I try to export the PDF its missing the icons and showing as low.

[somesoni2]

AFAIK, there is no way for that. The PDF engine doesn't respect lot of table formatting, including this one.