No, its not working that way. OK I will provide some more details. Here is my Splunk Query:
index="_internal" source="metrics.lo" group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","syslog")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | fields connectionType sourceIp sourceHost sourcePort destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server build version os arch guid |stats latest(version) by sourceHost os connectionType arch|search sourceHost=$Host$|stats count|eval Value= if(count == 0, 0, 1)| rangemap field=Value severe=150-200 low=0-100 | fields - Value
I tried with both fields - count and fields - Value , but no is still appearing. Is there any way I can hide this count from dashboard xml. The corresponding entry in xml is:
<title>Availability of $Host$</title>
<searchString>....</searchString>
<earliestTime>rt-60s</earliestTime>
<latestTime>rtnow</latestTime>
<option name="drilldown">none</option>
<option name="classField">range</option>
<option name="linkView">search</option>
</single>
Please help
... View more