Deal Splunkers,
I'm doing a serach like this to valorize a SingleValue indicator with range:
<my search> | eval secondsElapsedToday = now()-relative_time(now(), "@d") | eval _time=_time-secondsElapsedToday | bucket _time span=1d | stats count by _time | stats last(count) as today_count avg(count) as avg_count | eval range = case(today_count<avg_count, "low", today_count=avg_count, "elevated", today_count>=avg_count, "severe")
The problem is that if in the last day there aren't events the indicator show the last picked value. Is there any way to say that if in the last day value is absent the search have not to pick the earlier value?
thank you
