How to display a table icon for a certain process status?

[proylea]

Hi

I would like to show a list of processes and use the table icon set to show the status of the process, either existing (running) or not:
Green Tick for existing and Red Cross for not.

I can understand how to show a running process with a green tick next to it, but how do you show a non existing process with a red cross next to it? I'm assuming I would need to compare what was or should be existing with what is currently running.

An example of how to do this would be greatly appreciated.

Kind Regards
Peter

[MuS · Accepted solution]

Hi proylea,

you would need a lookup to keep track of the expected processes and use this lookup as comparison to the search.
Take a look at this answer http://answers.splunk.com/answers/73268/search-for-hosts-in-a-lookup-but-not-in-splunk.html to get an idea how it can be done; this was done to get hosts from a lookup which do not show in a search.

Hope this helps ....

cheers, MuS

[proylea]

Thanks that's exactly what I was looking for