I need to show circular icons in Red, Amber, Green on basis of my node status.

[rtprohan]

There are three nodes node01, node02, node03 if all nodes are up and running it should give a green color to circular icon, if any one node is down it should show amber and if all are down show me red color.

[niketn · Accepted solution]

You need to come up with your search to calculate nodesup count based on which icon and color will be set using respective evals below. Following is a run anywhere search to test icon and single value color based on values 0,1,2,3 etc.

| makeresults
| eval nodesup=0
| eval count=nodesup
| eval icon=case(nodesup=="3", "check-circle", nodesup=="2" OR nodesup=="1","exclamation-circle", nodesup=="0","times-circle",true(),"times-circle")
| eval color=case(nodesup=="3", "#65a637", nodesup=="2" OR nodesup=="1","#F58F39", nodesup=="0","#d93f3c",true(),"#d93f3c")
| table count icon color

Following are some Simple XML settings but you can set the same using UI through Edit > Format Visualization and choosing Field Value for Both Icon and Color

    <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
    <option name="status_indicator_app.status_indicator.fillTarget">background</option>
    <option name="status_indicator_app.status_indicator.icon">field_value</option>
    <option name="status_indicator_app.status_indicator.precision">0</option>
    <option name="status_indicator_app.status_indicator.showOption">1</option>
    <option name="status_indicator_app.status_indicator.useColors">true</option>

Refer to Status Indicator Documentation if you need more details: https://docs.splunk.com/Documentation/StatusIndicator/latest/StatusIndicatorViz/StatusIndicatorSearc...

[rtprohan]

Thanks niketnilay. I was looking for the same. Could you also guide me how can I display check-circle, exclamation icon. Do I need new app to be installed on splunkbase. Currently I am working on Splunk 6.6 version.

[niketn]

If you are using Status Indicator app, then icons should show up... from the Edit > Format Visualization You should select Show both Icon and Value and for icon make sure you are using Field Value and not Static. Same goes for Colors also but seems like color is working for you. As mentioned in the document, you need to have table with fields in the same sequence i.e. Value Icon and Color.

[rtprohan]

Thanks..this really helped me.