How to make a piechart with 2 different "values" 1 "value" is all the "= 0" in green, and the rest in red?

[michaelnorup]

index="***********" sourcetype="**********" (host="*")
| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats latest(AvailableUpdates) as AvailableUpdates by host

Hey guys.

So I have a search that gives a table as such:

Host __________________ AvailableUpdates

Host1_________________ = 21
Host2__________________= 0
Host3__________________= 5
Host4__________________= 0
Host5__________________ null

I am looking to make a piechart with 2 different "values"
1 "value" is all the "= 0" in green, and the rest in red.

Can't quite figure out how to sort this. 

Tyvm

[michaelnorup]

Ok, so i changed the search to 

index="******" sourcetype="**********" (host="*")
| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats count by AvailableUpdates | chart count by AvailableUpdates

Now i would like to group it in to just 2 groups as stated above instead of the 4 groups as now

[ITWhisperer · Accepted solution]

Do you mean something like this?

| rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)"
| table _time _raw host AvailableUpdates
| stats count by AvailableUpdates 
| eval status=if(AvailableUpdates=0,"green","red")
| chart count by status

[michaelnorup]

Yea that almost did the trick thanks,

Think you could remove the index and sourcetype from your reply?


Also, can i have more than 1 value in the eval status=if(value1=something AND value2=something etc) ?

It didnt actually color the chart correctly though. Also is there a way to get the actual count to show inside the chart aswell? 🙂

[ITWhisperer]

You can use the charting option

        <option name="charting.seriesColors">[0x00ff00,0xff0000]</option>