index=serverX sourcetype=CAServer
| dedup ID
| stats count
| eval status=if(count=00,"XXX is ok","XXX is not ok")
| rangemap field=count low=0-0 severe=1-100
This works and replies with 34 counts and is red, however i want to return the status with the red not just the number. I can return the status with
| stats status
but it is in black and white, any help is appreciated.
Completed this,
I added
| table status, range
got rid of any colour on the dashboard and the colour of the range took over.
Completed this,
I added
| table status, range
got rid of any colour on the dashboard and the colour of the range took over.