One scenario at a time, please? Let's solve this one, and then ask your other one in a different question.
Anyways, I ran your search prior to the search sourceHost=$Host$ line, and I got a table with five columns: sourceHost , os , connectionType , arch and latest(version) .
Doing the search sourceHost=$Host$ line will return the same table but listing only entries containing that host.
Doing stats count will return a table with just a count column and one row with the value representing the number of entries in the previous table.
Doing eval Value= if(count == 0, 0, 1) gets you a table with two columns, count and Value , and one row, with a number in count and either 1 or 0 in Value .
Doing rangemap field=Value severe=150-200 low=0-100 results in a table with count , Value and range columns, and one row. (Note, it makes no sense to do this. Value is always either 0 or 1. Doing a rangemap where low=0-100 will always get you low . I think you want to do the rangemap on count .)
Doing fields - Value count gets me just the range column, which I think is what you want. I made a simple dashboard with your search a tweaked version of your CSS, and I got a green "low", shifted over with space for the background image (which I don't have). Worked with a 7-day regular search and a 30-min realtime search.
There's nothing special about the query you have posted. The 'fields -` clause works for me here, and it should work for you, too.
... View more