Dashboards & Visualizations

How to edit my single value visualization search to fill a default rangemap value when the result is "No Results Found"?

JoshuaJohn
Contributor

I have this single value visualization search:

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | sort +Alert | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

If there is an alert for Webstore, this works perfectly. But when there are no alerts, I get "No Results found". Instead I want it to say Webstore and be green. Any ideas?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

View solution in original post

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...