rangemap not working on dashboard but working when doing a search

[michael_peters]

My search returns values and when I run it in search it colours the values correctly:

stats distinct_count(Incident_Number) as test| rangemap field=test low=0-0 default=severe

When I put this as a panel in a dashboard the values are not coloured at all.

I am running 6.0, any ideas why?

The full search is:

* NOT INC_CAL* Priority=1| convert timeformat="%F %T" ctime(Last_Modified_Date) AS "LastModified" ctime(Approval_Date) AS "ApprovalDate" ctime(Completion_Date) AS "CompletionDate" ctime(Submit_Date) AS "SubmitDate" ctime(Expected_Date) AS "ExpectedDate" ctime(Closed_Date) AS "ClosedDate" ctime(Resolved_Date) AS "ResolvedDate" ctime(Reported_Date) AS "ReportedDate" ctime(Responded_Date) AS "RespondedDate"| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-0 default=severe

[nfilippi_splunk · Accepted solution]

You might be missing the classfield option in your single value xml.

Here is a test dashboard to show the various values of rangemap.

<dashboard>
    <label>Range map color tests</label>
    <row>
        <single>
            <title>low - green</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo low=0-1 | table foo range</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>elevated - yellow</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo elevated=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>severe - red</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo severe=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>high - orange</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo high=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>guarded - blue</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo guarded=0-1</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
        <single>
            <title>None - black</title>
            <searchString>| stats count | eval foo=1 | rangemap field=foo severe=2-3</searchString>
            <option name="classField">range</option>
            <option name="field">foo</option>
        </single>
    </row>
</dashboard>

[michael_peters]

Yes I do remember this now from my training. Thanks +1.

[hemendralodhi]

Thanks a lot for the answer. I was struggling for past 2 hours and it finally worked with classField option. Many thanks.