Hello everybody,
How can I create a rule that controls a conditional table?
For example, there's a table with a specific css that shows a red icon, a green icon and an yellow icon over status based on the math distance ( number variation ) compared to the average.
So I would have, if the difference is
- 20% panel should show green.
- From 20% to %50 panel should show yellow
- Above 50% should show red.
So I have a conditional if, based on an average, this is my current search, but I have to keep in mind that these averages are based on last 14 events.
index=main sourcetype=full VALUE1=* VALUE2=* PROCESS_NAME=*
| eval TOTAL_VALUE = (VALUE1+VALUE2)
| eval AVERAGE = stats avg(TOTAL_VALUE )
| eval RULE = if(TOTAL_VALUE > AVERAGE , "HIGHER", if(TOTAL_VALUE < AVERAGE , "LOWER", "EQUAL"))
| table TOTAL_VALUE RULE
It should fit the app Splunk 6x Dashboard Examples (https://apps.splunk.com/app/1603/)
For a table with red, yellow and green icons.
Thanks in advance!
