How to edit my search to display "Incomplete" on a single value dashboard if a log is not found?

[jnichols914]

Hi Everyone,

I've looked over the answers for my problem, but I can't seem to get this working correctly. Here is what I want: If I do not find a log for my search, I want my single value dashboard widget to state "Incomplete" and show it in red font. I've got the the single value working if my search is found. Any help would be awesome.

Search that Picks up log correctly, but need it to say "Not Complete" if log is not found:

<query goes here> | eval status=if(like(_raw, "%gcmMtmReports%"), "EU Run Completed", "EU Run Not Complete") | eval status="EU Run Completed" | dedup status  | eval status=if(isnull(status),"Not Complete!", status) | table status | eval range=if(status="EU Run Completed","low","severe")

[somesoni2]

Give this a try. If you query has no data, it'll a row with status="Not Complete!" with range="severe"

<query goes here> | eval status=if(like(_raw, "%gcmMtmReports%"), "EU Run Completed", "EU Run Not Complete") | eval status="EU Run Completed" | dedup status  | eval status=if(isnull(status),"Not Complete!", status) | table status | eval range=if(status="EU Run Completed","low","severe") | appendpipe [| stats count| where count=0 | eval status="Not Complete!" | eval range="severe" | table status, range]

[jnichols914 · Accepted solution]

OK, So I figured out a solution. Not exactly what I wanted, but this works with what we are trying to do. Please see my XML below. This should help people for the future.

    <panel>
          <title>Blah</title>
          <single>
            <search>
              <query><query goes here" | stats count as "Reports Generated" |untable _time count value | eval range=if(value==0,"severe","low")</query>
              <earliest>$field1.earliest$</earliest>
              <latest>$field1.latest$</latest>
            </search>
            <earliest>$field1.earliest$</earliest>
            <latest>$field1.latest$</latest>
            <option name="underLabel">Green = Completed | Red = Incomplete</option>
            <option name="showSparkline">1</option>
            <option name="showTrendIndicator">1</option>
            <option name="trendColorInterpretation">standard</option>
            <option name="trendDisplayMode">absolute</option>
            <option name="unitPosition">after</option>
            <option name="useColors">1</option>
            <option name="useThousandSeparators">1</option>
            <option name="linkView">search</option>
          </single>
        </panel>

[sundareshr]

See if this works

| eval status=if(like(_raw, "%gcmMtmReports%"), "Completed", "NotComplete") 
| stats count by status
| eval "Completed"=if(isnull(Completed) OR Completed=0, "Not Complete", "EU Run Completed")
| table "Completed" 
| eval range=if(status="EU Run Completed", "low", "severe")

[jnichols914]

Sundareshr,

If my log exsists, your query is returning "Not Complete" and in red. So, it did not fix the issue.