Dashboards & Visualizations

Dashboard single and rangemap

preben12
Communicator

How can I make use of the rangemap when my search returns statis values like [OK or ERROR or WARN] and display a single value with a icon for each ERROR = server, OK = low and WARN = guarded.

Somehow I have to translate the ERROR ect. to a number to make use of rangemap i guess ?

The search = index=something | sort - _time
The search returns a status and a timestamp where only the resent value should count.

Normally the single value works like this :

<single>
        <searchString>| stats count as value | eval value = 550 | rangemap field=value none=0-99 low=100-199 guarded=200-299 elevated=300-399 high=400-499 severe=500-599 default=none</searchString>
        <earliestTime>-15m</earliestTime>
        <latestTime>now</latestTime>
        <option name="classField">range</option>
        <option name="field">value</option>
    </single>
Tags (2)
0 Karma
1 Solution

ziegfried
Influencer

You can use the eval command to translate values using the if() or case() functions. For example

index=something | sort - _time | eval range=case(status == "OK", "low", status == "WARN", "guarded", status == "ERROR", "severe")

View solution in original post

ziegfried
Influencer

You can use the eval command to translate values using the if() or case() functions. For example

index=something | sort - _time | eval range=case(status == "OK", "low", status == "WARN", "guarded", status == "ERROR", "severe")

preben12
Communicator

perfect !!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...