I have a search that I pipe into a table that will output a number. I can color the single value chart based on that fine, but we would rather see a string than a number in this single value field.
|eval status_code = case(Total>=1 AND severity_level=="Critical", "Critical", Total==0, "OK")
|eval color_code = case(Total>=1 AND severity_level=="Critical", "105", Total==0, "100")
|rangemap field=color_code 100=100-100
|table status_code
If I do table range
instead of table status_code
the output is 100. I was under the impression that if the rangemap
command set the range to 100, it would match the XML of the dashboard and change color, but even though clearly rangemap is setting it to 100, it does not change on the dashboard.
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[100,101,102,103]</option>
The problem is that when you call | table status_code
, you throw away the range
field that is created by the rangemap
command.
Try this run-anywhere XML and go from there:
<dashboard>
<label>eraseme</label>
<row>
<panel>
<single>
<search>
<query>index=_* | stats count by host | table count host</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>