I'm attempting to build a dashboard that will have several single value panels that will be displaying text outputs of eval functions.
But I can not get the background color range to function at all based on the eval results.
host=<removed>* sourcetype=syslog ("Updated to versions" OR "Updating from versions")
| rex Updat\w+\s(?<Status>\w+\s\w+)
| rex SAV:\s(?<SAV>\d+\.\d+\.\d+)
| rex Engine:\s(?<Engine>\d+\.\d+\.\d+)
| rex Data:\s(?<Data>\d+\.\d+)
| sort by host, _time, Status
| dedup SAV Engine Data host
| replace "from versions" WITH "Starting Version" IN Status
| replace "to versions" WITH "Version Changed" IN Status
| stats earliest(_time) as start, latest(_time) as stop, earliest(SAV) as eSAV, latest(SAV) as lSAV, earliest(Data) as eData, latest(Data) as lData, earliest(Engine) as eEngine, latest(Engine) as lEngine by host
| convert ctime(start) ctime(stop)
| eval cSAV=If(lSAV-eSAV!=0,"Updated","Unchanged")
| rename cSAV as "Virus Definition"
| table "Virus Definition" | eval range=if(lSAV-eSAV!=0,"0","5") | rangemap field=range low=0-0 severe=1-5
My panel will output the appropriate eval result (Updated or Unchanged) but the background coloring will stay black no matter what I've tried in previous questions.
... View more