Hello Ninjas - I am not sure if I am having a brain fart or if I am just not grasping this. Seeking some help, please. I have searched for a good few hours now and have read several of the docs.
I have a simple index populated with REST API calls that return a single word. "alive" or "dead" as the field "state" Splunk ver 7.0.3
I am trying to build a dashboard panel that will sit on a KPI dashboard. We have a rather vanilla system so no apps that would probably do this for me. The result I want for each host is a single value. The trellis view is appealing because I wouldn't have to go through using a base search (but maybe i have to) and then create multiple single values.
So a Single Value; value displayed is the "state" and the color should be representative of the state, but I see the ranges must be numerical so I eval'd a numerical value field based on the state value called "state_sev".
The code snippet below returns the "state" but does not change colors. If I change the `
↧