Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Single value module question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what i'm looking to do and i can't figure it out. I want a single value module to green up once a certain event shows up and go red when a different event shows up and instead of the module displaying the number of events, i want it to show the src address that is in the event. Any suggestions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.
The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":
eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")
In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.
...
<module name="SingleValue">
<param name="field">src_ip</param>
<param name="classField">range</param>
</module>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked like a charm. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.
The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":
eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")
In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.
...
<module name="SingleValue">
<param name="field">src_ip</param>
<param name="classField">range</param>
</module>
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)
From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...
Application management with Targeted Application Install for Victoria Experience
