Unbale to view D3 Bubble Chart when i copy the files to different app.

[biec1]

Unbale to view D3 Bubble Chart when i copy the files to different app.
I have copied the following files to respective locations to a different splunk instance and to a different app.
I have restarted splunk.

/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/bubblechart/bubblechart.js
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/bubblechart/bubblechart.css
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/bubblechart/bower.json
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/autodiscover.js

What should be the path for this?
data-require="splunkjs/mvc/searchmanager"

This path does not exists even in the original example app.
data-require="app/simple_xml_examples/components/bubblechart/bubblechart"

[niketn]

@biec1, the first path for splunkjs is common path and will not require change.

If you have migrated from existing path to a corresponding path in your Splunk App folder, you need to change simple_xml_examples with your Splunk App folder name i.e. replace simple_xml_examples:

   data-require="app/simple_xml_examples/components/bubblechart/bubblechart"

with the app name that you have created (following example uses your_app_name as the new app name):

   data-require="apps/your_app_name/appserver/static/components/"

Additionally you will also need to migrate the d3 folder from simple_xml_examples app to your own app folder (the same is referred by bubblechart.js):

/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/d3

Please try out and let us know how it goes.

PS: Since this visualization requires, JS and CSS you might require Splunk restart and also clearing of browser cache for new changes to reflect.

[biec1]

After making the mentioned changes, the bubble chart is showing the values in the format processor:hits in plain text.
This plain text is colored based on the values of name.

But the bubbles(Circles) are not getting showed.
Splunk has been restarted.

Query:-
| stats latest(usage) as hits by name,processor

[niketn]

Just curious what happens when you perform | stats latest(usage) as hits by name? Does the bubble show up?

[biec1]

I am not using bubble chart anymore. Its not suitable for my requirement.
I want to show heat map of the host field, based on the result of var1.
If var1 returns 1 for particular host , the heat map should show red block with host name.
If var1 returns 0 for particular host , the heat map should show green block with host name.

I could not find the examples in this app suitable for this.

index=index_name earliest=-15m@s 
| stats latest(_time) as Time avg(cpu_total) as cpu_usage by host _time
| eval var1=if(cpu_usage > 10,1,0) 
| where var1 == 1
| sort 0 -_time
| dedup host 
| table Time host cpu_usage

[niketn]

If you are on Splunk 6.5, You can either try Calendar Heat Map custom visualization or else even Punchcard Custom Visualization.
If not Splunk 6.x Dashboard examples has these implemented through JS and CSS.

[biec1]

Thank you.
Punchcard Custom Visualization is not suitable for the requirement.
Calendar Heat Map custom visualization view is suitable. But the problem is that each block in the Heat map represents a time frame. Instead of time frame, each block should represent one server and it should change color based on the values we supply.

[niketn]

Check out Horizon Chart where you have fixed timeline and can bring together different stats and compare the difference. Like CPU from Several Hosts at the same time.

Punchcard should be able to depict what you need as well.