I have a bar graph that charts two values. When one of the values is 0, the graph removes the column altogether. This makes it difficult to ascertain that two values are being compared. How can I keep a placeholder for a 0 value in the graph with the field name intact?
Thanks. However I'm having a bit of trouble with the sentinel value implementation (found on pages 25-27).
index=myIndex AND sourcetype=mySource AND ("string1" OR "string2") | eval split=if(match(_raw, ".*string1*."), "Requests", "Timeouts") | inputlookup append=true Timeouts | chart count by split
The above query returns 'The lookup table Timeouts is invalid'. What am I missing?
If you are creating an ad-hoc lookup, you must use
Timeouts.csv. When you specify a lookup without
.csv on the end, Splunk looks for a
Lookup definition named, in this case,
Timeouts, to see if it is a
Lookup file or a
KV Store. It does not find such and gives you this error. The other way around it is to create a lookup definition called
Timeouts that is file-based as
Don't forget to click
Accept to close the question.