Splunk Search

How to write custom Text for a Search result?

tobi2k
Explorer

For my Dashboard I ping a Source and want to see to Text-States: UP or DOWN.

My search statement looks similar like this:

index="main" source="ping" dest="mydomain.com" | stats latest(packet_loss>=0)

A Result >=0 should output DOWN
A Result 0 should output UP

Any Ideas how to archive this?

Thank you!

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

[updated]:

index="main" source="ping" dest="mydomain.com"|stats latest(packet_loss) as result |eval result = if(result>0,"DOWN","UP")

View solution in original post

tobi2k
Explorer

Thank you! Looks like its very close.

Unfortunately the result is "DOWN" although the result is 0.

alt text

alt text

0 Karma

vnravikumar
Champion

Hi

I had updated the query above, try it. If it works please accept the answer.

0 Karma

tobi2k
Explorer

Awesome! Thank you! Works like a charm!

0 Karma

vnravikumar
Champion

Hi

Try this

[updated]:

index="main" source="ping" dest="mydomain.com"|stats latest(packet_loss) as result |eval result = if(result>0,"DOWN","UP")
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...