I have this single value visualization search:
index="nitro_summary" earliest=-1h@m latest=@m [| `nitro_relationships` | search Category="ECOMM" Service="*" Application="Webstore" | stats count by Application | table Application] | join Application [ | `nitro_relationships` ] | search Alert_Type="*" Metric_Category="*"| eval FilterKey=Description.ID | dedup FilterKey | table Alert_Type Category Service Application Metric_Category Description Weight Key ID| rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | stats sum(Weight) as weight | sort +Alert | eval weight=100-weight | rangemap field=weight low=76-100 elevated=50-75 severe=0-50 default=low |eval weight="Webstore"
If there is an alert for Webstore, this works perfectly. But when there are no alerts, I get "No Results found". Instead I want it to say Webstore and be green. Any ideas?
↧