All Apps and Add-ons

Using Status Indicator Visualization with no events found (count should be set to 0 instead of NULL)

brandonbachman
Engager

I am using the following query to create a visualization that turns green if there are events, and if there are no events the background turns red.

server="SERVER-1"
| stats count by server
| eval server="SERVER-1", color=if(count<=0, '#dc4e41", "#65a637"),icon=if(count<=0,"times-circle","check-circle")
| table server icon color count

The visualization works correctly when there are events found (the background is green with a check icon).
However, when there are no events found, a message appears that says "No results found. Try expanding the time range."

Instead of "No results found" I would like count to be set to 0 which will make the background turn to red and make the icon change.
How do I make it so count is set to 0 so that the values for color and icon change to red and "times-circle"?

When there are no events I need count to be set to 0 instead of null

0 Karma
1 Solution

493669
Super Champion

Hi @brandonbachman,
as per solution from @woodcock -
Add this to the bottom of your search SPL string:

 | appendpipe [stats count | where count=0]

View solution in original post

493669
Super Champion

Hi @brandonbachman,
as per solution from @woodcock -
Add this to the bottom of your search SPL string:

 | appendpipe [stats count | where count=0]

joshimeister
Loves-to-Learn Lots

Hello @493669 ,

Im running into the same issue with the 0 value. Not sure what im doing wrong. I tried your suggestion but that didnt work for me.

Original query without your suggestion:

<query><basic query> error_field="*CRASHED*"
 | rex field=error_field "<error field content extracted with rex command>"
| stats count AS crashed_count BY app_name,org_name,space_name,name,crash_reason
| rangemap field=crashed_count #65a637=0-0 #F93208=1-9 #f58f39=10-99 #d93f3c=100-10000 default=#65a637
| rename range as range_color
| rangemap field=crashed_count ambulance=0-0 optin-monster=1-9 warning=10-99 stethoscope=100-10000 default=ambulance
| rename range as range_icon
| table crashed_count range_icon range_color</query>

 

With your suggestion:


<query><basic query> error_field="*CRASHED*"
 | rex field=error_field "<error_field content extracted with rex command>"
| stats count AS crashed_count BY app_name,org_name,space_name,name,crash_reason
| rangemap field=crashed_count #65a637=0-0 #F93208=1-9 #f58f39=10-99 #d93f3c=100-10000 default=#65a637
| rename range as range_color
| rangemap field=crashed_count ambulance=0-0 optin-monster=1-9 warning=10-99 stethoscope=100-10000 default=ambulance
| rename range as range_icon
| table crashed_count range_icon range_color
| appendpipe [stats count | where crashed_count=0]</query>

  

0 Karma

brandonbachman
Engager

That worked, thank you!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...