I have the following view:
<form>
<label>Booking Data</label>
<!-- define a search that returns, in one result set, all of the data that is
needed by the subsequent panels -->
<searchTemplate>source="*rvngistats.log" host="*prod*" statsLogger.com.pegs.rvng.mdb.OTAMessageListener PAYLOAD transactionType="*" | stats count(eval(transactionType LIKE "%LSRQ")) as totalCount count(eval(transactionType LIKE "BOOKRQSS%")) as book count(eval(transactionType LIKE "BOOKRQXX%")) as cancel | eval look_book=round(totalCount/book) | eval net_book=book-cancel</searchTemplate>
<fieldset>
<input type="time" />
</fieldset>
<row>
<single>
<searchPostProcess>| stats max(book)| rangemap field=book default=severe low=0-500</searchPostProcess>
<title>Gross Bookings</title>
<option name="field">max(book)</option>
</single>
<single>
<searchPostProcess>| stats max(cancel)| rangemap field=cancel default=severe low=0-500</searchPostProcess>
<title>Cancels</title>
<option name="field">max(cancel)</option>
</single>
<single>
<searchPostProcess>| stats max(net_book)| rangemap field=net_book default=severe low=0-500</searchPostProcess>
<title>Net Bookings</title>
<option name="field">max(net_book)</option>
</single>
</row>
</form>
The form works as expected; the SV panels get populated with the correct numbers for book, cancel, and net_book. However, the background on the SV buttons is always blue, no matter what values are displayed. I had expected it to be green when the values are between 0 and 500, but no such luck. What have I missed?
Ah Hah. Stephen is correct, plus I was missing
<option name="classField">range</option>
in the
This is because your stats
output fields called max({book,cancel,net_book})
but your rangemap command looks for the field in {book,cancel,net_book}
. You can either change the field=
argument to rangemap to look in the max(...)
field or rename the field in stats
using as {book,cancel,net_book}
and change the <option name="field">
values as well.
That makes sense, Stephen, thanks. Apparently though I've failed some basic grok here, because we don't get colorized with this either:
book
max(cancel)