Splunk Search

How to add icons to a table in Splunk 5?

jagadish85
Path Finder

Hi,

I want to add icon to a table. I am using Splunk 5.

My table looks as

Module    Version    Requests    Errors    Status
xxx         1.1          5          2       green
yyyy        1.0         10          5      yellow
zzzz        2.0         18         10        red

I am using rangemap to show the status = |rangemap field=Status green=0-3 yellow=4-9 red=10-100

Instead of green, yellow, and red, I want to show the icons.

This is for splunk 5.0

Tags (2)

sideview
SplunkTrust
SplunkTrust

This is possible in Splunk 5 if you use the Sideview Utils app. Make sure to use the latest version from the Sideview site at http://sideviewapps.com/apps/sideview-utils/ instead of the out of date version on apps.splunk.com.

Once you follow the download/install instructions and get the app installed, navigate in the menu to "Module Documentation > Table > Embedding Examples"

Definitely read that page because it will tell you way more than this, but here's an example for you as well.

<module name="Search">
   <param name="search"><![CDATA[
     * | head 1000 | timechart count | delta count as change | eval icon=if(change>0,"sort_asc",if(change<0,"sort_desc","none"))
   ]]></param>

   <module name="Table">
     <module name="HTML" group="row.fields.icon">
       <param name="html"><![CDATA[
         <img src="/static/app/sideview_utils/images/arrow_$row.fields.icon$.gif">
       ]]></param>
     </module>
   </module>        
 </module> 

Obviously you would modify the example to reference icon images in your own app, but since there are in fact image files in $SPLUNK_HOME/etc/apps/sideview_utils/appserver/static/ called "arrow_sort_asc" and "arrow_sort_desc", this XML above should work out of the box.
Note that while the URL is "/static/app/sideview_utils/images/", the actual filesystem path is "/etc/apps/sideview_utils/appserver/static/". This tends to confuse everyone so it bears repeating. 😃

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...