Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Problem with custom decorations and dashboards

changux
Builder
‎07-27-2017 04:18 PM

Hi, everyone!

I am trying to display green/red buttons when a condition returns 0 or 1.

My query is:

index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | stats count by value  | fields value | rangemap field=value  up=1-1 down=0-0 none=2-2 default=none

Depends on my maild daemon data indexed, it returns value=1 | range=up or value=0 | range=down and works very well.

To show a nice button, i'm using this css:

.custom-result-value {
    font-size: 55px;
    margin: 35px auto;
    text-align: center;
    font-weight: bold;
    color: rgb(85, 85, 85);
}
.custom-result-value:before {
    font-family: "Splunk Icons";
    font-style: normal;
    font-weight: normal;
    text-decoration: inherit;
    font-size: 110%;
}
.down.custom-result-value:before {
    content: "\2297";
}
.down.custom-result-value {
    color: rgb(217, 63, 60);
}
.up.custom-result-value {
    color: rgb(101, 166, 55);
}
.up.custom-result-value:before {
    content: "\ECD3";
}
.custom-result-value.icon-only {
    font-size: 90px;
}

And finally the dashboard:

<dashboard stylesheet="custom_decorations.css">
    <label>temp</label>
    <description>
        This example shows decorations using tokens from search results, HTML panels and some custom CSS. The icon are displayed using the Splunk Icon Font.
    </description>
    <row>
        <panel>
            <search>
                <query>
                index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | stats count by value  | fields value | rangemap field=value  up=1-1 down=0-0 none=2-2 default=none
                </query>
                <progress>
                    <set token="value1">$result.value$</set>
                    <set token="range1">$result.range$</set>
                </progress>
            </search>
            <html>
                <div class="custom-result-value $range1$">
                    $value1$ 
                </div>
            </html>
        </panel>
....

But doesn't work. The dashboard shows the red button when the value=1. I double checked in other search window and the query returns value=1 | range=up. Why inside my dashboard data doesn't look as desired?

Thanks!

Tags (3)
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

changux
Builder
‎07-27-2017 04:55 PM

I changed my query by:

index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none

And works!!!!

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

changux
Builder
‎07-27-2017 04:55 PM

I changed my query by:

index="myindex" sourcetype="mysource"  | eval value=if(maild="running","1","0") | top value showcount=f showperc=f | rangemap  field=value  up=1-1 down=0-0 none=2-2 default=none

And works!!!!

0 Karma
Reply
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...