Dashboards & Visualizations

How to edit my single value visualization search to fill a default rangemap value when the result is "No Results Found"?

JoshuaJohn
Contributor

I have this single value visualization search:

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | sort +Alert | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

If there is an alert for Webstore, this works perfectly. But when there are no alerts, I get "No Results found". Instead I want it to say Webstore and be green. Any ideas?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

View solution in original post

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...