Dashboards & Visualizations
Highlighted

single value always show invalid field

Communicator

Hi, can somebody help me in this.. it always show invalid field and i cant change the color of the single value ..

heres my code..

sourcetype=smart_gtp Completed |stats dc(msisdn) |rangemap field=dc(msisdn) low=0-0 elevated=1-1 default=severe





*
False
1


splunk.search.job
True
1


dashboard


totalsubscriber.html

totalsubscribers_today


dc(msisdn)
range

Tags (2)
0 Karma
Highlighted

Re: single value always show invalid field

Path Finder

It might help to give the dc(msisdn) value a new fieldname in your search string. Try this:

sourcetype=smart_gtp Completed | stats dc(msisdn) as msisdndc  | rangemap field=msisdndc low=0-0 elevated=1-1 default=severe
0 Karma
Highlighted

Re: single value always show invalid field

Communicator

i already try that but still it shows invalid field
i decided to make it in basic xml




totalsubscriberstoday
1314201600
1314287940

range

sourcetype=smart_gtp Completed |stats dc(msisdn) as msisdndc|rangemap field=msisdndc low=0-10 elevated=11-1000000000 default=severe

the result in this code is "red word" the color of the singlevalue still not change and the no. number msisdndc does not show

0 Karma
Highlighted

Re: single value always show invalid field

SplunkTrust
SplunkTrust

Can you include the exact search string of your saved search totalsubscriberstoday? I think the answer is just that it's output rows either dont have a "dc(msisdn)" or dont have a field called "range", but I'd have to see the search string.

0 Karma