my search string is
sourcetype=health | head 1 | rangemap field=status default=severe elevated=2-2 low=1-1 | eval field=if(status==1 OR status==2, "Connected", "Not Connected")
and
sourcetype="log" pid_status earliest="-30s" latest=now | dedup host | head 3 | where pid_status="(Active)" | stats count | rangemap field=count low=2-2 default=severe | eval count=case(count == 0, "Not Running", count == 1, "Not Running", count == 2, "Active", count == 3, "Not Running")
above search works fine in version 4.3.3, build 128297 and I can see colored rectangle.
but when I deploy this in latest version of Splunk - I can't see any colored rectangle in anywhere my app. I am using rangemap in four different view.
is this bug or something wrong in my app?
I have also installed sideview_util app.
Thanks
... View more