I am using
| fillnull totalCount in my search so I get an 0 when there is no result.
The color range I use is from min to 0 is green, from 0 to max is red.
Somehow the '0' is still showing red. Is there any way to change this?
|filnull totalCount value=0. Also, make sure color configuration is saved properly to save the dashboard and refresh the browser page. Otherwise, the configuration (min-0 green and 0-max red) works for me. (I'm using Splunk version 7.2) Check XML would look like:
<option name="rangeColors">["0x53a051","0xdc4e41"]</option> <option name="rangeValues"></option>
Hope this helps!!!
Niet aangekomen Verint
Make sure you have something like this for your colors in xml :
<option name="rangeColors">["0x65a637","0xd93f3c"]</option> <option name="rangeValues">[0.99]</option>
Also since this makes 0-0.99 green you can use 0.1 instead for
fillnull if 0 is still not working :
...|fillnull value=0.1 totalCount or force to zero just in case :
...|fillnull value=0 totalCount