Hi
I use the code below
In the case of no FreeSpace event exists, I would like to display the message "No disk pace events for this host" in my single panel
How doing this please?
`diskspace`
| fields FreeSpaceKB host
| eval host=upper(host)
| eval FreeSpace = FreeSpaceKB/1024
| eval FreeSpace = round(FreeSpace/1024,1)
| search host=$tok_filterhost$
| stats latest(FreeSpace) as FreeSpace by host
| table FreeSpace
`diskspace`
| fields FreeSpaceKB host
| eval host=upper(host)
| eval FreeSpace = FreeSpaceKB/1024
| eval FreeSpace = round(FreeSpace/1024,1)
| search host=$tok_filterhost$
| stats latest(FreeSpace) as FreeSpace by host
| eval FreeSpace=FreeSpace."GB"
| table FreeSpace
and delete option.
`diskspace`
| fields FreeSpaceKB host
| eval host=upper(host)
| eval FreeSpace = FreeSpaceKB/1024
| eval FreeSpace = round(FreeSpace/1024,1)
| search host=$tok_filterhost$
| stats latest(FreeSpace) as FreeSpace by host
| table FreeSpace
| appendpipe [|stats count
| eval FreeSpace="No disk pace events for this host"
| where count = 0 | table FreeSpace ]
There must have been something made by @woodcock about it before, but I've forgotten.
Thanks, it works fine but ..
In my xml , i format my single value like this
<option name="unit">GB</option>
So if "No disk space for this events" is true what is displayed is "No disk space for this events GB".....
`diskspace`
| fields FreeSpaceKB host
| eval host=upper(host)
| eval FreeSpace = FreeSpaceKB/1024
| eval FreeSpace = round(FreeSpace/1024,1)
| search host=$tok_filterhost$
| stats latest(FreeSpace) as FreeSpace by host
| eval FreeSpace=FreeSpace."GB"
| table FreeSpace
and delete option.
it works but in this case I lost the color format vizualization I use
ex : 0 to 32 : red color
32 to 50 : orange color
Thanks Would you confirme that with this code the color palette will continue to work fine? ( i cant test ot today sorry)?
You've got it; that's the way to do it, but it was originally from @martin_mueller .
Every query has its own history. thanks @woodcock