I have 3 single rangemap fields configured in a dashboard. All 3 field values are actually 0. However, one of the values (for delete) is always shown as 'low' instead of '0'.
Here is the search to verify values:
sourcetype=rfsctl-a* earliest=-24h | rex field=_raw "megastore.stats.decode_errors: (?
--> with results
avg_decode_errors avg_delete_errors display_value_decode display_value_delete
0.000000 0.000000 0 0
display_value_delete shows as 'low' in the UI
Here is the xml:
range
range
range
Check out the answer from zeigfried:
I think that's what you're after.
Do you know "defalut=low" means? You may need to delete it in order to achieve your purpose?
... | rangemap field=display_value_encode low=0-1 elevated=2-10 severe=11-1000 default=low
Can you change the rangemap search as following and let me know if this sovle?
... | rangemap field=display_value_encode low=0-1 elevated=2-10 severe=11-1000