OK, Let me tell you another scenario. Here is the splunk Query: index = azuremetricservice source="wmi:service" Name="MSSQLSERVER" | eval State=State|eval Value =if(State=="Running",1,0) | rangemap field=Value severe=0-0 low=1-100 The output is an icon. Now as soon as I make above query to execute in real time. The name MSSQLSERVER is getting displayed. How is this possible that upon making query real time the name is appearing. -Hitesh ... View more

Eve if I remove these fields the name of the VM starts to appear, then if I write fields - sourceHost then os name begin to appear, likewise. After removing all fields to appear once again the Value fields begins to appear which is not getting removed even after writing fields - Value. I understand while writing normal query if you write fields - Value then Value wont be there in result. But the case is regarding this query. So I think the query needs to be changed. Please help me in correcting this query to remove fields Moreover I cannot remove search clause as I have to check the availibility of that VM. ... View more

No, its not working that way. OK I will provide some more details. Here is my Splunk Query: index="_internal" source="metrics.lo" group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","syslog")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | fields connectionType sourceIp sourceHost sourcePort destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server build version os arch guid |stats latest(version) by sourceHost os connectionType arch|search sourceHost=$Host$|stats count|eval Value= if(count == 0, 0, 1)| rangemap field=Value severe=150-200 low=0-100 | fields - Value I tried with both fields - count and fields - Value , but no is still appearing. Is there any way I can hide this count from dashboard xml. The corresponding entry in xml is: <title>Availability of $Host$</title> <searchString>....</searchString> <earliestTime>rt-60s</earliestTime> <latestTime>rtnow</latestTime> <option name="drilldown">none</option> <option name="classField">range</option> <option name="linkView">search</option> </single> Please help ... View more

I think its the Value field which evaluates to either 0 or 1. I tried fields - Value. But still the number is coming over there. Its not count field. Its Value field which is used in rengemap function -Hitesh ... View more

Hi, I tried this option but count is still appearing. Best Regards Hitesh ... View more

Yes I agree with Mahamed. I removed it from the Cluster and was able to search its data in Cluster Search Head -Hitesh ... View more

Yes,P3 is already having some data. But my requirement is: 1) P3 data should not get replicated in P1 and P2. 2) P1 and P2 data should not get replicated in P3. Is there any way we can configure P3 to exhibit above behaviour. Best Regards Hitesh ... View more