Dashboards & Visualizations

How to edit my single value visualization search to fill a default rangemap value when the result is "No Results Found"?

Contributor

I have this single value visualization search:

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | sort +Alert | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

If there is an alert for Webstore, this works perfectly. But when there are no alerts, I get "No Results found". Instead I want it to say Webstore and be green. Any ideas?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

View solution in original post

SplunkTrust
SplunkTrust

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

View solution in original post