Hello,
I have a log entry that will display: Processor being destroyed
And when it does (within my real-time search (all time)), I want to display Yes (Green) in a dashboard panel.
When it has not yet occurred, I want the dashboard panel to display No (Red).
If yes/no is not possible and True/False is, then that is ok too. 🙂
Thanks!
Sounds like you might want to check out using rangemap with a single value panel : http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Rangemap#Using_rangemap_with_singl...
Look at the SPlunk 6.x dashboard example app (link below) and look at the examples for Single value. You'll find similar/better options to achieve the same.
Unfortunately we're only on 6.2, so we have some limitations with single values.
Does anyone have any examples they have setup pre 6.3?
The above app does work for 6.2.
If you just want to display Yes/No for value in the single value panel, you can have your search like this (sample)
your base search "Processor being destroyed" | head 1 | stats count | eval result=if(count=1,"True","False") | table result
That's perfect! Thanks for that.
Would you happen to know how to make the text on "True" green & the text color on "False" red?