I am trying to achieve below requirement 1- Calculate the error rate label for multiple application if Error Rate greater than50%, mark "DOWN" in red; if Error Rate > 5% & <50%, mark "ISSUE" in Orange; else "UP" in Green. 2- After label column done then needs to create new widget with single value and check the all the labels (DOWN, ISSUE, UP) if any (at least one) APIs in Error Rate is "DOWN", show "DOWN" in red; If any APIs in Error Rate is "ISSUE", show "ISSUE" in orange; else "UP" in green. Note- I need single text value result This is code i wrote till now but still not able to fullfill my requirement   <panel> <single> <title>Error Rate</title> <search> <query> app_name-abc OR app_name=xyz | rex field msg "\"[^\"]*\"\s(?&lt;status&gt;\d+)" | stats count(eval(status&gt;-200 AND status&lt;-300)) as pass count, count(eval(status&gt;-400)) as fail_count by cf_app_name | eval error rate (fail_count/ (pass_count + fail_count)) 100 | eval label if (error rate &gt; 50, "DOWN", if(error_rate &gt; 5, "ISSUE", "UP")) | eval error rate round(error_rate, 2) "X" rename error_rate AS "Error_rate(percent)" | stats count(eval(label="DOWN")) as down_count, count(eval (label-"ISSUE")) as issue count, count(eval (label-"UP")) as up_count | rangemap field-issue_count low-0-0 high-2-99 default-low | eval Status-case(down_count &gt;-1, "DOWN", down_count=0 AND issue_count&gt;-1, "ISSUE", 1--1, "UP") </query> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="field">Status</option> <option name="rangeValues">ISSUE, UP</option> <option name="rangeColors">orange, green</option> <option name="drilldown">none</option> <option name="field"> Status</option> <option name="drilldown">none</option> </single> </panel>           ... View more

Hey @carasso and @splunk team I want to build the splunk query using the below requirements: Data Source: sourcetypepcf app_name=xyz HTTP_PATH="/*" Time Frame: The query should cover a 4-week period (earliest=-4w). Display: Calculate and display the average count per hour for the current day of the week for HTTP_STATUS_CODE.  Using the reference #https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-Chart-Average-of-Last-4-Thursdays-vs-Today-in-a-Timechart/m-p/167913?_ga=2.262359695.2003626727.1695023755-301331303.1687328075&_gl=1*y4c9e*_ga*MzAxMzMxMzAzLjE2ODczMjgwNzU.*_ga_GS7YF8S63Y*MTY5NTAyMzkyOC4xLjEuMTY5NTAyNjA5Ny4wLjAuMA..*_ga_5EPM2P39FV*MTY5NTAyMzc1Ni4yLjEuMTY5NTAyNjA5OS4wLjAuMA.. We build the query but while we calculate the average we are getting zero results. Query is - [search ] earliest=-4w | eval current_day = strftime(now(), "%A") | eval log_day = strftime(_time, "%A") | where current_day == log_day | timechart span=1h avg(count) by HTTP_STATUS_CODE. I would except to take the average by hour for all 4 days and build the timechart span by 1hours for 24 hours.   Can you please for the same... ... View more