Using Text Field ("Up", "Down") for Single Value in Dashboard and Changing Colors

[aferone]

I am trying to use a field in my log (status) that either says "Up" or "Down". I have to convert this into a number for the rangemap command:

      <single>
      <title>Network Monitoring - Jabber</title>
      <option name="classField">range</option>
      <option name="field">status</option>    
      <searchTemplate>host=hostname sourcetype="sourcetype" | head 1 | eval alert_level = case(status=="up",1,status=="down",2) | rangemap field=alert_level green=0-0 red=1-2

(For some reason the ending /searchtemplate and /single tags are missing when I paste them into this question form.)

I cannot get this work. I also want to word "Up" or "Down" to either be green or red, respectively.

Any help would be appreciated, and thank you!

[lguinn2 · Accepted solution]

I think the main thing is that there is no tag "searchTemplate" in a simple XML dashboard panel. It's "searchString." Also, you didn't have your ranges set properly.

 <single>
      <title>Network Monitoring - Jabber</title>
      <option name="classField">range</option>
      <option name="field">status</option>    
      <searchString>host=hostname sourcetype="sourcetype" | head 1 | eval alert_level =   
              case(status=="up",1,status=="down",2) | rangemap field=alert_level low=1-1 severe=2-2
       </searchString>
</single>

[aferone]

Thank you!!

[moisesroth]

Nice! I was searching for this a long long time.

If you try to simulate this on "Search" it won't work. This feature works only on views/dashboards.

For understand this berravior I test it using the following generic search:

<single>
  <title>Network Monitoring - Jabber</title>
  <option name="classField">range</option>
  <option name="field">status</option>    
  <searchString>index=* | head 1 | eval status="up" | head 1 | eval alert_level =   
    case(status=="up",1,status=="down",2) | rangemap field=alert_level low=1-1 severe=2-2
  </searchString>
</single>