Splunk Search

How to write custom Text for a Search result?

tobi2k
Explorer

For my Dashboard I ping a Source and want to see to Text-States: UP or DOWN.

My search statement looks similar like this:

index="main" source="ping" dest="mydomain.com" | stats latest(packet_loss>=0)

A Result >=0 should output DOWN
A Result 0 should output UP

Any Ideas how to archive this?

Thank you!

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

[updated]:

index="main" source="ping" dest="mydomain.com"|stats latest(packet_loss) as result |eval result = if(result>0,"DOWN","UP")

View solution in original post

tobi2k
Explorer

Thank you! Looks like its very close.

Unfortunately the result is "DOWN" although the result is 0.

alt text

alt text

0 Karma

vnravikumar
Champion

Hi

I had updated the query above, try it. If it works please accept the answer.

0 Karma

tobi2k
Explorer

Awesome! Thank you! Works like a charm!

0 Karma

vnravikumar
Champion

Hi

Try this

[updated]:

index="main" source="ping" dest="mydomain.com"|stats latest(packet_loss) as result |eval result = if(result>0,"DOWN","UP")
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...