Hello all,
I have the following search:
<search>
<!-- ITA -->
<query>index=mon1 data{}.testType!="https" data{}.id="95809" source="*LOAD*" | stats latest(data{}.status) as status | lookup mon-status status OUTPUT value as value_full | eval value_fyc=[ search data{}.id="167934" source="*FYC" | stats latest(data{}.status) as status | lookup mon-status status OUTPUT value | return $value ] | eval value=$value_full$ + $value_fyc$ | rangemap field=value low=0-400 severe=401-999 default=low</query>
<finalized>
<condition match="'job.resultCount' == 0">
<set token="value1">0</set>
<set token="range1">severe</set>
</condition>
<condition>
<set token="value1">$result.value$</set>
<set token="range1">$result.range$</set>
</condition>
</finalized>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
If I run the query in the search app, it runs fine and I have a table with all the values populated.
In my dashboard I use a CSS to display an icon based on range (i.e. if "severe" display a red cross):
<row>
<panel>
<html>
<a>
<h1>
<center>SYS1</center>
</h1>
</a>
<div class="custom-result-value icon-only $range1$"> </div>
</html>
</panel>
</row>
but this is not working anymore after I added the subsearch in my query.
I'm not sure the token contains the right value, is there a way to debug it ?
thanks,
Fausto
