Hi.
I want to show single value decorations with a dashboard that is built with saved searches (reports). I checked the examples of the Dashboard examples app, that suggest:
<searchString>| stats count as value | eval value = 550 | rangemap field=value none=0-99 low=100-199 guarded=200-299 elevated=300-399 high=400-499 severe=500-599 default=none</searchString>
My code is:
<search ref="RPT_search_data_example"></search>
I don't have the searchstring, I have the reference to the saved report.
Also, I modified the base report (RPT_search_data_example) and added the | rangemap ...
code but doesn't work. Any suggestion? I knew that change my search tags by searchString is the plan B.
Thanks!
Finally, the only option was replace the report on the dashboard to a searchstring
.
Thanks!
Finally, the only option was replace the report on the dashboard to a searchstring
.
Thanks!
Here's a good thread on single value decorations
http://answers.splunk.com/answers/111390/using-single-value-decorations.html