I'm looking to create a view that shows whether a service is up or down. Does anyone have an example of how to chart a sort of green light/red light display on a view?
Assuming you have a field called 'state' with binary values 0/1 you could do something like:
<my search> | head 1 | rangemap field=state low=0 default=severe
In the above search "head 1" get's us the last state. You could also do this with 'stats last(state)'. Rangemap is a command that maps field values into ranges. In this case we map 0 to low (green) and 1 to severe (red)
Assuming you have a field called 'state' with binary values 0/1 you could do something like:
<my search> | head 1 | rangemap field=state low=0 default=severe
In the above search "head 1" get's us the last state. You could also do this with 'stats last(state)'. Rangemap is a command that maps field values into ranges. In this case we map 0 to low (green) and 1 to severe (red)
