Dashboards & Visualizations

single value always show invalid field

xisura
Communicator

Hi, can somebody help me in this.. it always show invalid field and i cant change the color of the single value ..

heres my code..

sourcetype=smart_gtp Completed |stats dc(msisdn) |rangemap field=dc(msisdn) low=0-0 elevated=1-1 default=severe





*
False
1


splunk.search.job
True
1


dashboard


total_subscriber.html

total_subscribers_today


dc(msisdn)
range

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

Can you include the exact search string of your saved search total_subscribers_today? I think the answer is just that it's output rows either dont have a "dc(msisdn)" or dont have a field called "range", but I'd have to see the search string.

0 Karma

sfleming
Splunk Employee
Splunk Employee

It might help to give the dc(msisdn) value a new fieldname in your search string. Try this:

sourcetype=smart_gtp Completed | stats dc(msisdn) as msisdndc  | rangemap field=msisdndc low=0-0 elevated=1-1 default=severe
0 Karma

xisura
Communicator

i already try that but still it shows invalid field
i decided to make it in basic xml




total_subscribers_today
1314201600
1314287940

range

sourcetype=smart_gtp Completed |stats dc(msisdn) as msisdndc|rangemap field=msisdndc low=0-10 elevated=11-1000000000 default=severe

the result in this code is "red word" the color of the singlevalue still not change and the no. number msisdndc does not show

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...