Dashboards & Visualizations

How to edit my single value visualization search to fill a default rangemap value when the result is "No Results Found"?

JoshuaJohn
Contributor

I have this single value visualization search:

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | sort +Alert | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

If there is an alert for Webstore, this works perfectly. But when there are no alerts, I get "No Results found". Instead I want it to say Webstore and be green. Any ideas?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

View solution in original post

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...