How To Add Custom Emoji In Splunk Dashboard (PART-II)
In our previous blog of this particular series we have discussed in detail adding custom emojis into the Splunk dashboard, you can check it out from the below link.
“How To Add Custom Emoji In Splunk Dashboard”
Today we will do that same stuff in an alternative way. While doing the previous method we have faced some problems. In some of the instances in dark mode, the unicode character (emoji) doesn’t properly load. Also sometimes if there is JS and CSS used in the dashboard the icons don’t load properly. It wasn’t showing any error but we were sure that due to those unicode characters or emoji this bug was occurring. That is why today we are back with another alternative way of doing this, still we won’t use any JS or CSS. we will make it simple!
So let’s start the proceeding.
Here we have this query,
index=_internal sourcetype=splunkd_ui_access | stats count by method status bytes | dedup method status
Here we will create a field called “Transit”, which will be based on the below conditions
method=GET and status=200 ----> ✅ method=GET and status>200 ----> ⛔ method=DELETE --------------------> ❌ method=POST ------------------------> ❓
Before doing this we will save the above query in a dashboard,
Then go to this following website,
https://www.w3schools.com/charsets/ref_emoji.asp
Or
https://www.codetable.net/unicodecharacters
Here you will get decimal code for those unicode characters you need. Instead of using the emoji directly, we will use the respective decimal code.
Now create the required condition with eval command separately,
|eval Transit=case(method="GET" AND status=200,"✅",method="GET" AND status>200,"⛔",method="DELETE","❌",method="POST","❓",0=0,"⏳")
Now go to the dashboard and click on edit and source code,
Now in the source code paste that query with the “decimal code”.
And save the dashboard.
Now see the dashboard is loading with the ICONS properly.
Happy Splunking!!
