Why does one search properly color the text of the returned search result, but the other search does not?

[agoktas]

This successfully colors results accordingly:

index=myindex host=app01 source="C:\\Log1.txt" | rex "RecordsProcessedCount to (?<ProcessCount>\d+)" | stats max(ProcessCount) as ProcessCount | rangemap field=ProcessCount low=4000-91128 severe=0-3999

This does not color results:

index=myindex host=app02 source="C:\\Log2.txt" | stats count as value | rangemap field=value low=0-500 severe=501-10000

They both bring back a single numeric result (one is based on a regex value and the other is simply a line count). Why would it work with the first search, but not the other (first is colored green, but the other defaults to black)?

Thanks!

[agoktas · Accepted solution]

Unfortunately I'm on version 6.2, so those options aren't available. 😞

Otherwise, I found the problem.

I needed to add:

range

to my dashboard's XML (source).

All is now good. 🙂

Thanks anyhow!

[akanno]

You can set it from [visualization] >> [format] >> [color] in Splunk version 6.3