Hi Team, How to replace no results found with 0 with a color in Splunk dashboard. I know that by appending below it update 'no results found' with 0 value. | appendpipe [stats count | where count=0] But it comes with red color as 0 value, I want to change to green color. even if I have changed Format Visualization --> Color range  from 0-5 as Green 5-max as Red   Could you please let me know how I can get green color with value as 0 when there is 'no results found'  ... View more

I have 2 records for PaymentType as send and receive. I would like to extract PaymentType as receive only so that I can further compare. Could you please let me know how do I can extract PaymentType as receive only. transaction: {"version":1,"status":"approved","identifier":"0c4240e0-2c2c-6427-fb1f-71131029cd89","amount":"[REDACTED]","transactionAmount":"[REDACTED]","timestamp":"2024-06-13T04:29:20.673+0000","statusChangedTimestamp":"2024-06-13T04:29:56.337+0000","type":"payment","transferIdentifier":"cded3395-38f9-4258-90a5-9269abfa5536","currencyCode":"USD","PaymentType":"receive","senderHandle":"[REDACTED]","recipientHandle":"[REDACTED]","fees":[],"transferMode":"contact"} transaction: {"version":1,"status":"approved","identifier":"0c4240e0-2c2c-6427-fb1f-71131029cd89","amount":"[REDACTED]","transactionAmount":"[REDACTED]","timestamp":"2024-06-13T04:29:20.673+0000","statusChangedTimestamp":"2024-06-13T04:29:56.337+0000","type":"payment","transferIdentifier":"cded3395-38f9-4258-90a5-9269abfa5536","currencyCode":"USD","PaymentType":"send","senderHandle":"[REDACTED]","recipientHandle":"[REDACTED]","fees":[],"transferMode":"contact"} ... View more

Hi, I want to extract value c611b43d-a574-4636-9116-ec45fe8090f8 from below. Could you please let me know how I can do using rex field=httpURL   httpURL: /peerpayment/v1/payment/c611b43d-a574-4636-9116-ec45fe8090f8/performAction ... View more

Hi, I want to use timechart or bucket span to view the result every 30 mins using below query. Could you please let me know how I can use timechart or bucket span=30m _time here.   index=* handler=traffic <today timerange> | stats dc(dsid) as today_Traffic | appendcols [search index=* handler=traffic <yesterday timerange> | stats dc(dsid) as Previous_day_Traffic] | eval delta_traffic = today_Traffic-Previous_day_Traffic ... View more