Dashboards & Visualizations

How can I create a visualization of last events that includes color-coded results from three different time periods?

guab77
New Member

I'm trying to find the last instances of multiple events. For some of these instances, I want to know if they occurred in the last day, and for others if they occurred in the last month, and for the rest if they occurred in the last 3 days. If they did occur within their time period, I want the visualization for the instance to be colored green, and if they didn't, I want the visualization to be colored red. How would I go about creating a visualization that holds all of these events, and what is the best visualization to use?

0 Karma

woodcock
Esteemed Legend

I would just use a standard Statistics page and color code each cell.

0 Karma

niketn
Legend

@guab77, how are you planning to associate which job is associated with daily and which ones monthly occurences? Is there going to be a lookup or is it coming from indexed data?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hi @guab77! Have you had a chance to read through the documentation on visualizations? https://docs.splunk.com/Documentation/Splunk/6.6.2/Search/Createtimebasedcharts I saw this app as well for custom visualizations: https://splunkbase.splunk.com/app/3120/
I also saw this post on comparing multiple time ranges in one report: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...