Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Single value module question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what i'm looking to do and i can't figure it out. I want a single value module to green up once a certain event shows up and go red when a different event shows up and instead of the module displaying the number of events, i want it to show the src address that is in the event. Any suggestions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.
The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":
eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")
In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.
...
<module name="SingleValue">
<param name="field">src_ip</param>
<param name="classField">range</param>
</module>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked like a charm. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.
The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":
eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")
In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.
...
<module name="SingleValue">
<param name="field">src_ip</param>
<param name="classField">range</param>
</module>
App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community
Operationalizing Entity Risk Score with Enterprise Security 8.3+
Unlock Database Monitoring with Splunk Observability Cloud
