Hi, can somebody help me in this.. it always show invalid field and i cant change the color of the single value ..
heres my code..
sourcetype=smart_gtp Completed |stats dc(msisdn) |rangemap field=dc(msisdn) low=0-0 elevated=1-1 default=severe
My dashboard * False 1 splunk.search.job True 1 dashboard
total_subscriber.html total_subscribers_today
dc(msisdn) range
Can you include the exact search string of your saved search total_subscribers_today? I think the answer is just that it's output rows either dont have a "dc(msisdn)" or dont have a field called "range", but I'd have to see the search string.
It might help to give the dc(msisdn) value a new fieldname in your search string. Try this:
sourcetype=smart_gtp Completed | stats dc(msisdn) as msisdndc | rangemap field=msisdndc low=0-0 elevated=1-1 default=severe
i already try that but still it shows invalid field i decided to make it in basic xml
total_subscribers_today 1314201600 1314287940
range
sourcetype=smart_gtp Completed |stats dc(msisdn) as msisdndc|rangemap field=msisdndc low=0-10 elevated=11-1000000000 default=severe
the result in this code is "red word" the color of the singlevalue still not change and the no. number msisdndc does not show
