I'm working on creating a dashboard with a single panel view. My search is determining if i'm processing data in x, y or x+y. I can get the dashboard to correctly display the location but i'd like to have a color associated with each location. I've tried assigning a value to the location which then i can get the color to correctly appear but my associated number is listed in my dashboard and not the actual location. I've poured over these forums and google, not having much luck at least with how i'm currently restricted by my company.
| eval Location=case(like(host, "%ksc%"),"KSC",like(host, "%stl%"),"STL") | stats count by Location | eval Location=case(count > 10,Location) | dedup Location | eventstats count as "LocCount" | eval Location=if(LocCount > 1,"Co-Processing", Location) | eval Location=case(Location="KSC", 0, Location="STL", 5, Location="Co-Processing", 10) | stats values(Location)
... View more