Single value module question

[RicoSuave]

This is what i'm looking to do and i can't figure it out. I want a single value module to green up once a certain event shows up and go red when a different event shows up and instead of the module displaying the number of events, i want it to show the src address that is in the event. Any suggestions?

[RicoSuave]

This worked like a charm. Thanks.

[hazekamp · Accepted solution]

This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.

The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":

eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")

In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.

...
<module name="SingleValue">
  <param name="field">src_ip</param>
  <param name="classField">range</param>
</module>