Hello Splunkers,
Hoping someone can help or point me in the right direction. I am trying to color code my single value string based on value ranges they fall under. Here is my XML. What I am trying to do is make the string RUNNING green and DOWN red. What am I missing here? I'm on version 6.4. Thanks for all the help in advance.
<query>|stats count| fields - count | eval diff=2000| eval status=case(diff<=1500, "RUNNING", diff >1501, "DOWN") |rangemap field=status low=0-1500 severe=1501-9999</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="classField">range</option>
<option name="field">status</option>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x555555"]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
Try this search
|stats count| fields - count | eval diff=2000| eval status=case(diff<=1500, "RUNNING", diff >1501, "DOWN") |rangemap field=diff low=0-1500 severe=1501-9999 |table status range
Try this search
|stats count| fields - count | eval diff=2000| eval status=case(diff<=1500, "RUNNING", diff >1501, "DOWN") |rangemap field=diff low=0-1500 severe=1501-9999 |table status range
Arggg, so the field has to be the value and then a table command is needed. Thanks for the help, somesoni2 this got things working.