Dashboards & Visualizations

Does Splunk have a "Traffic Light"-control for a dashboard?

andyk
Path Finder

I would like to have a couple of controls/reports on my Dashboard that shows the current status of my services. If configurable thresholds are exceeded the control should show red, yellow, green.

Can Splunk do this out of the box?

1 Solution

ftk
Motivator

It does indeed do this out of the box. Take a look at the rangemap command. With it you can define buckets to colorize your events by. You can then use a SingleValue module to display the color. Note the classField parameter; if you are using rangemap to colorize the SingleValue box, set classField to "range" as such:

<option name="classField">range</option>

The pre-defined css classes for SingleValue are none, low, elevated, and severe. So if you want to use the out of the box css use rangemap like in the following example:

evettype=failed_login | stats count | rangemap field=count low=1-5 elevated=5-10 severe=10-9999999 default=None

View solution in original post

jitsinha
Path Finder

is it possible to use it with real time searches??

0 Karma

markthompson
Builder

I would imagine so, all it is is a case of setting a range value, at which the CSS picks it up and transforms it into the traffic light.

Try it and see what comes of it, and let us know! 🙂

0 Karma

jitsinha
Path Finder

No its not working with real time search.
Let say for a low value I have green color on the dashboard, but it should have been yellow once the returned result breaches the threshold. BUt its reflecting the changes only after refreshing the dashboard.

0 Karma

himynamesdave
Contributor

Update: check this demo app complete with examples of how to use traffic lights in Splunk 6.x - https://apps.splunk.com/app/1923/

0 Karma

ftk
Motivator

It does indeed do this out of the box. Take a look at the rangemap command. With it you can define buckets to colorize your events by. You can then use a SingleValue module to display the color. Note the classField parameter; if you are using rangemap to colorize the SingleValue box, set classField to "range" as such:

<option name="classField">range</option>

The pre-defined css classes for SingleValue are none, low, elevated, and severe. So if you want to use the out of the box css use rangemap like in the following example:

evettype=failed_login | stats count | rangemap field=count low=1-5 elevated=5-10 severe=10-9999999 default=None

lguinn2
Legend

You can also use Simple XML to specify the classField option.

andyk
Path Finder

Found it, problem solved. Works great!

0 Karma

ftk
Motivator

You specify it as an option to the SingleValue module in your advanced dashboard XML. Check out the following doc topic for an intro to advanced XML: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedIntro

0 Karma

andyk
Path Finder

Where do I set "range"? Should I edit a file or is it done through the webgui?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...