All Apps and Add-ons

Status Indicator - Is there anyway to output trellis vertically?

kwestlake
Engager

Hi All

I've been putting together a demo-dashboard as part of a blog-post I'm writing, showing how to use Elastic Beat (Heatbeat and Metricbeat) agents with Splunk.  Currently this shows how many apps are up/down, how many VMs are up/down etc,  this main relies upon the Status Indicator viz.

But I'm wondering, if anybody could assist with some styling. By default Status Indicator outputs as follows:

Default styleDefault style

 

I'm looking to present it stacked, like this:

Is this possible?Is this possible?

 

This is was butchered together using paint, but hopefully it gives the idea. I'd have several of these in a row (Apps, VM's, Network Interfaces, APs etc).

The dashboard viz code is as follows:

 

 

 

      <viz id="app_panel" type="status_indicator_app.status_indicator">
        <title>APPLICATIONS:</title>
        <search>
          <query>`beats_http_icmp_macro`
| where monitor_tags in ("app", "media")

| stats latest(monitor_name) as name 
        latest(monitor_status) as status 
		BY monitor_name, monitor_type

| stats count(name) as "   UP"
        sum(eval(if(status=="down",1,0))) as    " DOWN"
		
| eval fn = "value"
| transpose column_name="category" header_field=fn

| eval color = if(category=="   UP", "#006d9c", "#dc4e41")
| eval icon = if(category=="   UP", "cloud", "times-circle")
| sort category
| stats last(value) as value  last(icon) as icon last(color) as color by category</query>
          <earliest>$time_field.earliest$</earliest>
          <latest>$time_field.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="height">144</option>
        <option name="refresh.display">progressbar</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">text</option>
        <option name="status_indicator_app.status_indicator.fixIcon">cloud</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">category</option>
      </viz>

 

 

 

 Many Thanks

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...