We're using Splunk to monitor EDI traffic onto our backend system. We want to have a single value panel that shows green when an order has been received, yellow, when there's been no order and it's prior to 16:00 and red when there's been no order and it's 16:00+
Here's the command I used, but the isnull always returns 0 even when EDI-count is greater than 0.
source="C:\\Monitor\\Vista\\EDI\\EDISPLUNK.csv" NOT _raw="Date,Time,Type,Account,Name,Order Qty,EAN,SAN,Order Ref,Order Date,From1,From2" host="Vista-EDI2" AND Name="Companyname*"
| stats count as EDI-count
| eval Time=now()
| convert timeformat=%H:%M ctime(Time)
| eval Got=if(isnull(EDI-count),0,1)
| eval Test=case(Got=0 and Time>="16:00",0,Got=0 and Time<"16:00",2,Got=1,4)
| rangemap field=Test low=4-5 elevated=2-3 default=severe
... View more