Hi,
I want to add icon to a table. I am using Splunk 5.
My table looks as
Module Version Requests Errors Status
xxx 1.1 5 2 green
yyyy 1.0 10 5 yellow
zzzz 2.0 18 10 red
I am using rangemap to show the status = |rangemap field=Status green=0-3 yellow=4-9 red=10-100
Instead of green, yellow, and red, I want to show the icons.
This is for splunk 5.0
This is possible in Splunk 5 if you use the Sideview Utils app. Make sure to use the latest version from the Sideview site at http://sideviewapps.com/apps/sideview-utils/ instead of the out of date version on apps.splunk.com.
Once you follow the download/install instructions and get the app installed, navigate in the menu to "Module Documentation > Table > Embedding Examples"
Definitely read that page because it will tell you way more than this, but here's an example for you as well.
<module name="Search">
<param name="search"><![CDATA[
* | head 1000 | timechart count | delta count as change | eval icon=if(change>0,"sort_asc",if(change<0,"sort_desc","none"))
]]></param>
<module name="Table">
<module name="HTML" group="row.fields.icon">
<param name="html"><![CDATA[
<img src="/static/app/sideview_utils/images/arrow_$row.fields.icon$.gif">
]]></param>
</module>
</module>
</module>
Obviously you would modify the example to reference icon images in your own app, but since there are in fact image files in $SPLUNK_HOME/etc/apps/sideview_utils/appserver/static/ called "arrow_sort_asc" and "arrow_sort_desc", this XML above should work out of the box.
Note that while the URL is "/static/app/sideview_utils/images/", the actual filesystem path is "/etc/apps/sideview_utils/appserver/static/". This tends to confuse everyone so it bears repeating. 😃
See the answer by @Sideview here the same.