Dashboards & Visualizations

SingleValue Panel - replace Value with Text

nwe
Explorer

Dear all,

I created SingleValue Panels on my dashboard which shows me a status of a Application. This is my search:

... | stats count as errors | rangemap field=errors low=0-0 default=severe  | replace 0 with "Service OK"

I replaced 0 with Service OK because it looks better on the monitoring TV. This works fine but I cannot change values > 0 to Service NOK. The replace function only works with string. So if Splunk counts errors, it shows me a number on my dashboard. I want to keep rangemap in my search because I want a green color if value is 0 and red color if value > 0.

Is there any other function I could use for this?

Thanks in advance for your help.

Greets nwe

Tags (2)
1 Solution

nwe
Explorer

I found Solution with eval and Regex...

| stats count as errors | rangemap field=errors low=0-0 default=severe | replace 0 with "Service OK" | eval errors = replace (errors,"[1-9]+","Service NOK")

Thanks for helping.

View solution in original post

nwe
Explorer

I found Solution with eval and Regex...

| stats count as errors | rangemap field=errors low=0-0 default=severe | replace 0 with "Service OK" | eval errors = replace (errors,"[1-9]+","Service NOK")

Thanks for helping.

martin_mueller
SplunkTrust
SplunkTrust

eval and if or case?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Rangemap has a hard time doing anything if you strip off the range field afterwards.

0 Karma

nwe
Explorer

I tried eval this but rangemap function doesnt work anymore because of new field.

... | stats count as errors | rangemap field=errors low=0-0 default=severe | eval status = if(errors = 0, "Service OK", "Service Down") | fields - errors, - range

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...