I'm monitoring log files and want to generate reports using the most recent event types I'm seeing an inconsistent number of results when I run a search: index="myindex" source="/var/log/mysource" | dedup name sortby -_time | eventstats sum(passed) AS totalpassed | eventstats sum(failures) AS totalfailures | table totalpassed,totalfailures | head 1 I think my problem is the dedup statement, but can't figure out how. I tried different time intervals, but since these checks are run every minutes, I should be seeing the same results each search using the last 15 minutes. ... View more

I have JSON data that is broken into fields. I'm trying to add color to my stats panel or pivot table, but I'm unable to do so with my string data. Example event: { "name": "foo", "status": "HEALTHY" } I can create a search that I can use as a panel for my dashboard: index="myindex" sourcetype="mysourcetype" | table name,status I'd like to have the resultant rows in my stats table turn green if HEALTHY (red if some other status, like DEGRADED). I've tried editing my XML to include: <option name="charting.fieldColors"> but for some reason this does not seem to work with my string data. Ideally, the whole row of name + status would turn a solid background color, but just the status changing would be okay. <option name="charting.fieldColor">{"HEALTHY":0x00FF00,"DEGRADED":0xFF0000}</option> I also tried creating a pivot table and mapping HEALTHY to a number and color, but I feel there must be an easier way. I have yet to explore JS/CSS options. Thanks! ... View more