My Query-sourcetype="source1" "queue.1" OR "queue.2" OR "queue.2" | spath output=queueName path=qInfo.qName|spath output=pendingMsgCount path=qInfo.pendingMsgCount|dedup queueName|stats sum(pendingMsgCount) AS PendingMsgCount by _time queueName|
stats sum(PendingMsgCount) as Totalcount | eval Status=case(Totalcount=0, "Fine", Totalcount>=1 AND Totalcount<=10, "Warning", Totalcount>10, "Critical") |chart values(Totalcount) AS TotalCount by Status
Output
Status=Fine,TotalCount=0...I want the Full pie chart to be Green colour for this status or Total Count
If Status=Warning,TotalCount>0 and <5-Full Pie chart yellow..like wise...
Piechart should display the TotalCount too with respective colour.
Thanks in advance!
... View more