Splunk Search

How to write custom Text for a Search result?

Explorer

For my Dashboard I ping a Source and want to see to Text-States: UP or DOWN.

My search statement looks similar like this:

index="main" source="ping" dest="mydomain.com" | stats latest(packet_loss>=0)

A Result >=0 should output DOWN
A Result 0 should output UP

Any Ideas how to archive this?

Thank you!

Tags (1)
0 Karma
1 Solution

Champion

Hi

Try this

[updated]:

index="main" source="ping" dest="mydomain.com"|stats latest(packet_loss) as result |eval result = if(result>0,"DOWN","UP")

View solution in original post

Explorer

Thank you! Looks like its very close.

Unfortunately the result is "DOWN" although the result is 0.

alt text

alt text

0 Karma

Champion

Hi

I had updated the query above, try it. If it works please accept the answer.

0 Karma

Explorer

Awesome! Thank you! Works like a charm!

0 Karma

Champion

Hi

Try this

[updated]:

index="main" source="ping" dest="mydomain.com"|stats latest(packet_loss) as result |eval result = if(result>0,"DOWN","UP")

View solution in original post