topic Re: single value always show invalid field in Dashboards & Visualizations

single value always show invalid field

xisura — Mon, 28 Sep 2020 09:54:00 GMT

Hi, can somebody help me in this.. it always show invalid field and i cant change the color of the single value ..

heres my code..

sourcetype=smart_gtp Completed |stats dc(msisdn) |rangemap field=dc(msisdn) low=0-0 elevated=1-1 default=severe

My dashboard

*
False
1

splunk.search.job
True
1

dashboard

total_subscriber.html

total_subscribers_today

dc(msisdn)
range

Re: single value always show invalid field

sfleming — Fri, 23 Sep 2011 06:04:03 GMT

It might help to give the dc(msisdn) value a new fieldname in your search string. Try this:

sourcetype=smart_gtp Completed | stats dc(msisdn) as msisdndc  | rangemap field=msisdndc low=0-0 elevated=1-1 default=severe

Re: single value always show invalid field

xisura — Mon, 28 Sep 2020 09:54:03 GMT

i already try that but still it shows invalid field
i decided to make it in basic xml

total_subscribers_today
1314201600
1314287940

range

sourcetype=smart_gtp Completed |stats dc(msisdn) as msisdndc|rangemap field=msisdndc low=0-10 elevated=11-1000000000 default=severe

the result in this code is "red word" the color of the singlevalue still not change and the no. number msisdndc does not show

Re: single value always show invalid field

sideview — Mon, 28 Sep 2020 09:54:23 GMT

Can you include the exact search string of your saved search total_subscribers_today? I think the answer is just that it's output rows either dont have a "dc(msisdn)" or dont have a field called "range", but I'd have to see the search string.