The initial query was not specific enough.
As soon as I added a sourcetype at the front of this query it was fixed, any value below 9 actually shows up as the value and is coloured green:
sourcetype="remedy_incidents" * NOT INC_CAL* Priority=2| convert timeformat="%F %T" ctime(Last_Modified_Date) AS "LastModified" ctime(Approval_Date) AS "ApprovalDate" ctime(Completion_Date) AS "CompletionDate" ctime(Submit_Date) AS "SubmitDate" ctime(Expected_Date) AS "ExpectedDate" ctime(Closed_Date) AS "ClosedDate" ctime(Resolved_Date) AS "ResolvedDate" ctime(Reported_Date) AS "ReportedDate" ctime(Responded_Date) AS "RespondedDate"| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-9 elevated=10-50
Also most of the query can be removed and simplified to:
sourcetype="remedy_incidents" * NOT INC_CAL* Priority=2| stats distinct_count(Incident_Number) as test| rangemap field=test low=0-9 elevated=10-50
... View more