Hi ,
I have a field which has 3 values i.e., 0 , 1 & 2.
0 for Green , 1 for Blue and 2 for Red. I'm using this values to show colour differences in dashboard.
But the search fetches data only at a particular time in a day , so the remaining time there is no data.
When there is no data , the dashboard is not loading.
I want to indicate no data with black colour in the dashboard.
How can I do that? where in if there is no day I can create and map a field value in dashboard
Its not working , because I'm tracking the field Status for colour change using below query
index = xyz sourcetype =abc
|eval Status =if(Statistic=0,"Green" , if(Statistic=2 ,"Red",if(Statistic=1,"Blue", " " )))
|stats latest(Status)
Can you please suggest according to above query?
I suspect you were too literal in applying my answer. Try this
index = xyz sourcetype =abc
| eval Status=case(Statistic=0,"Green" ,
Statistic=2,"Red",
Statistic=1,"Blue",
1==1, " " )
| appendpipe [ stats count | eval Status="Black" | where count=0 | fields - count]
| stats latest(Status)
Use the appendpipe command to add values when none are returned by your query.
<<your search>>
| appendpipe [ stats count | eval colour="black" | where count = 0 | fields - count]