Hello @493669 , Im running into the same issue with the 0 value. Not sure what im doing wrong. I tried your suggestion but that didnt work for me. Original query without your suggestion: <query><basic query> error_field="*CRASHED*" | rex field=error_field "<error field content extracted with rex command>" | stats count AS crashed_count BY app_name,org_name,space_name,name,crash_reason | rangemap field=crashed_count #65a637=0-0 #F93208=1-9 #f58f39=10-99 #d93f3c=100-10000 default=#65a637 | rename range as range_color | rangemap field=crashed_count ambulance=0-0 optin-monster=1-9 warning=10-99 stethoscope=100-10000 default=ambulance | rename range as range_icon | table crashed_count range_icon range_color</query>   With your suggestion: <query><basic query> error_field="*CRASHED*" | rex field=error_field "<error_field content extracted with rex command>" | stats count AS crashed_count BY app_name,org_name,space_name,name,crash_reason | rangemap field=crashed_count #65a637=0-0 #F93208=1-9 #f58f39=10-99 #d93f3c=100-10000 default=#65a637 | rename range as range_color | rangemap field=crashed_count ambulance=0-0 optin-monster=1-9 warning=10-99 stethoscope=100-10000 default=ambulance | rename range as range_icon | table crashed_count range_icon range_color | appendpipe [stats count | where crashed_count=0]</query>    ... View more

The "greater than" and "less than" signs must be encoded differently. Try using < in place of "less than" and > in place of "greater than" <row> <panel> <viz type="status_indicator_app.status_indicator"> <search> <query>host="HOST-1" | eval server="SERVER-1" | stats count by server | eval color=if(count<=0, "#dc4e41", "#65a637"),icon=if(count<=0, "times-circle", "check-circle") | table server icon color</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">3</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">false</option> </viz> </panel> </row> ... View more

<form> <row> <panel> <table> <search id="bStats"> <done> <condition> <set token="value3">$result.server$</set> <set token="color3">$result.color$</set> <set token="icon3">$result.icon$</set> </condition> </done> <query>| makeresults | eval server="SERVER-1" | stats count by server | eval color=if(count<=0, "#dc4e41", "#65a637"), icon=if(count<=0, "times-circle", "check-circle") | table server icon color</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <viz type="status_indicator_app.status_indicator"> <search base="bStats"> <query/> </search> <option name="height">115</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">1</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">false</option> </viz> </panel> </row> </form> Hi, @brandonbachman Simple xml : I want to create cool single value display html Please refer to the answer I asked earlier. ... View more

The time picker only considers _time. You can, however, search for other time fields. Here's one way, but I'm sure there are others. index=foo | eval ts=strptime(date,"%m/%d/%Y %H:%M:%S %p") | eval start=relative_time(ts,"@d+6h"), end=relative_time(ts,"@d+18h") | search ts>=start AND ts<end ... View more