Splunk Search

How to display a unit format and a color format in a single panel with an appendpipe subsearch?

jip31
Motivator

Hello

I use the search below

 

    [| inputlookup host.csv 
    | table host] `diskspace` 
| fields FreeSpaceKB host 
| eval host=upper(host) 
| eval FreeSpace = FreeSpaceKB/1024 
| eval FreeSpace = round(FreeSpace/1024,1) 
| search host=$tok_filterhost$ 
| stats latest(FreeSpace) as FreeSpace by host 
| table FreeSpace 
| appendpipe 
    [| stats count 
    | eval FreeSpace="No event for this host" 
    | where count = 0 
    | table FreeSpace ]

 

I use a color visualization in my color panel

 

jip31_0-1596513605857.png

jip31_1-1596513718812.png

 

The problem is that when the appendpipe condition is true, the message displayed is "No event for this host GB" instead "No event for this host"

I tried to delete the number format option and to add it in the code but it's the same problem

 

| eval FreeSpace=FreeSpace." GB" 

 

How can I keep the format option and the color option of my single panel with the appendpipe subsearch?

Thanks for your help

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...