This successfully colors results accordingly:
index=myindex host=app01 source="C:\\Log1.txt" | rex "RecordsProcessedCount to (?<ProcessCount>\d+)" | stats max(ProcessCount) as ProcessCount | rangemap field=ProcessCount low=4000-91128 severe=0-3999
This does not color results:
index=myindex host=app02 source="C:\\Log2.txt" | stats count as value | rangemap field=value low=0-500 severe=501-10000
They both bring back a single numeric result (one is based on a regex value and the other is simply a line count). Why would it work with the first search, but not the other (first is colored green, but the other defaults to black)?
Thanks!
Unfortunately I'm on version 6.2, so those options aren't available. 😞
Otherwise, I found the problem.
I needed to add:
range
to my dashboard's XML (source).
All is now good. 🙂
Thanks anyhow!
Unfortunately I'm on version 6.2, so those options aren't available. 😞
Otherwise, I found the problem.
I needed to add:
range
to my dashboard's XML (source).
All is now good. 🙂
Thanks anyhow!