Splunk Search

How to display a unit format and a color format in a single panel with an appendpipe subsearch?

Contributor

Hello

I use the search below

 

    [| inputlookup host.csv 
    | table host] `diskspace` 
| fields FreeSpaceKB host 
| eval host=upper(host) 
| eval FreeSpace = FreeSpaceKB/1024 
| eval FreeSpace = round(FreeSpace/1024,1) 
| search host=$tok_filterhost$ 
| stats latest(FreeSpace) as FreeSpace by host 
| table FreeSpace 
| appendpipe 
    [| stats count 
    | eval FreeSpace="No event for this host" 
    | where count = 0 
    | table FreeSpace ]

 

I use a color visualization in my color panel

 

jip31_0-1596513605857.png

jip31_1-1596513718812.png

 

The problem is that when the appendpipe condition is true, the message displayed is "No event for this host GB" instead "No event for this host"

I tried to delete the number format option and to add it in the code but it's the same problem

 

| eval FreeSpace=FreeSpace." GB" 

 

How can I keep the format option and the color option of my single panel with the appendpipe subsearch?

Thanks for your help

Labels (1)
Tags (2)
0 Karma