index="***********" sourcetype="**********" (host="*")
| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats latest(AvailableUpdates) as AvailableUpdates by host
Hey guys.
So I have a search that gives a table as such:
Host __________________ AvailableUpdates
Host1_________________ = 21
Host2__________________= 0
Host3__________________= 5
Host4__________________= 0
Host5__________________ null
I am looking to make a piechart with 2 different "values"
1 "value" is all the "= 0" in green, and the rest in red.
Can't quite figure out how to sort this.
Tyvm
Do you mean something like this?
| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats count by AvailableUpdates
| eval status=if(AvailableUpdates=0,"green","red")
| chart count by status
Ok, so i changed the search to
index="******" sourcetype="**********" (host="*")
| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats count by AvailableUpdates | chart count by AvailableUpdates
Now i would like to group it in to just 2 groups as stated above instead of the 4 groups as now
Do you mean something like this?
| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats count by AvailableUpdates
| eval status=if(AvailableUpdates=0,"green","red")
| chart count by status
Yea that almost did the trick thanks,
Think you could remove the index and sourcetype from your reply?
Also, can i have more than 1 value in the eval status=if(value1=something AND value2=something etc) ?
It didnt actually color the chart correctly though. Also is there a way to get the actual count to show inside the chart aswell? 🙂
You can use the charting option
<option name="charting.seriesColors">[0x00ff00,0xff0000]</option>