Dashboards & Visualizations

How to edit my single value visualization search to fill a default rangemap value when the result is "No Results Found"?

JoshuaJohn
Contributor

I have this single value visualization search:

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | sort +Alert | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

If there is an alert for Webstore, this works perfectly. But when there are no alerts, I get "No Results found". Instead I want it to say Webstore and be green. Any ideas?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 

View solution in original post

somesoni2
Revered Legend

Give this a try

index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM"  Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | appendpipe [stats count | where count=0 | eval weight=0 | table weight]  | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore" 
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...