How to show a single value field as a string?

[evan_roggenkamp]

I have a search that I pipe into a table that will output a number. I can color the single value chart based on that fine, but we would rather see a string than a number in this single value field.

|eval status_code = case(Total>=1 AND severity_level=="Critical", "Critical", Total==0, "OK")
|eval color_code = case(Total>=1 AND severity_level=="Critical", "105", Total==0, "100")
|rangemap field=color_code 100=100-100
|table status_code

If I do table range instead of table status_codethe output is 100. I was under the impression that if the rangemap command set the range to 100, it would match the XML of the dashboard and change color, but even though clearly rangemap is setting it to 100, it does not change on the dashboard.

<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[100,101,102,103]</option>

[woodcock]

The problem is that when you call | table status_code, you throw away the range field that is created by the rangemap command.

Try this run-anywhere XML and go from there:

<dashboard>
  <label>eraseme</label>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_* | stats count by host | table count host</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>