All Apps and Add-ons

Status Indicator - Is there anyway to output trellis vertically?

kwestlake
Engager

Hi All

I've been putting together a demo-dashboard as part of a blog-post I'm writing, showing how to use Elastic Beat (Heatbeat and Metricbeat) agents with Splunk.  Currently this shows how many apps are up/down, how many VMs are up/down etc,  this main relies upon the Status Indicator viz.

But I'm wondering, if anybody could assist with some styling. By default Status Indicator outputs as follows:

Default styleDefault style

 

I'm looking to present it stacked, like this:

Is this possible?Is this possible?

 

This is was butchered together using paint, but hopefully it gives the idea. I'd have several of these in a row (Apps, VM's, Network Interfaces, APs etc).

The dashboard viz code is as follows:

 

 

 

      <viz id="app_panel" type="status_indicator_app.status_indicator">
        <title>APPLICATIONS:</title>
        <search>
          <query>`beats_http_icmp_macro`
| where monitor_tags in ("app", "media")

| stats latest(monitor_name) as name 
        latest(monitor_status) as status 
		BY monitor_name, monitor_type

| stats count(name) as "   UP"
        sum(eval(if(status=="down",1,0))) as    " DOWN"
		
| eval fn = "value"
| transpose column_name="category" header_field=fn

| eval color = if(category=="   UP", "#006d9c", "#dc4e41")
| eval icon = if(category=="   UP", "cloud", "times-circle")
| sort category
| stats last(value) as value  last(icon) as icon last(color) as color by category</query>
          <earliest>$time_field.earliest$</earliest>
          <latest>$time_field.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="height">144</option>
        <option name="refresh.display">progressbar</option>
        <option name="status_indicator_app.status_indicator.colorBy">field_value</option>
        <option name="status_indicator_app.status_indicator.fillTarget">text</option>
        <option name="status_indicator_app.status_indicator.fixIcon">cloud</option>
        <option name="status_indicator_app.status_indicator.icon">field_value</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">1</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">category</option>
      </viz>

 

 

 

 Many Thanks

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...