I have a chart that show some ping times. I would like to show values with "NA" as red in the chart and set their values to 1000. Currently they just show up as zero. Here is my current search.
sourcetype="mysearch" host=host123* | timechart avg(internal_time) as "Ping Time"
Try like this
your current search | replace "NA" with 1000 in "Ping Time"
Give the solution from below post for colors
https://answers.splunk.com/answers/58335/change-chart-bar-color-based-on-data-value.html
Try like this
your current search | replace "NA" with 1000 in "Ping Time"
Give the solution from below post for colors
https://answers.splunk.com/answers/58335/change-chart-bar-color-based-on-data-value.html
Do you get a series/column named "N/A" ?
Currently I don't. I just see a bar chart with "Ping Time". If the value is not a number and is "NA" it shows up at 0 on my chart. I would like that so how up in red and have a value of 1000 instead of "NA"