All Apps and Add-ons

calendar heatmap viz force value=0 different color?

pmeyerson
Path Finder

Is there a way to force one of the color bins to be for 0 value? Or some other splunk ninja magic to gray out those days on the calendar heatmap? The data has high spikes and many 0s. | timechart span=1d limit=0 count by status. I have some days with low values that get colored the same as 0. Splunk 6.6.2. Thanks for any suggestions.

0 Karma
1 Solution

kmaron
Motivator

nulls are black instead of being colored. if you can force your zero's to be nulls or maybe only return data that is greater than zero your zeros will become null?

View solution in original post

kmaron
Motivator

nulls are black instead of being colored. if you can force your zero's to be nulls or maybe only return data that is greater than zero your zeros will become null?

arlington
Explorer

You saved my time, thanks !

0 Karma

dijikul
Communicator

This works, but has an unexpected bug (seemingly) --- for null values between the current date and the most-recent event, the boxes are colored grey rather than black.

0 Karma

arlington
Explorer

Actually, I used only search count>0 and it did what I was looking for

dijikul
Communicator

Yes! That did it! Search count>0 rather than converting to null, and the viz shows 0-counts as grey.

Perfect!

0 Karma

niketn
Legend

Adding to @kmaron's point try the following run anywhere search with Calendar Heat Map visualization:

index=_internal sourcetype=splunkd log_level!=INFO
| timechart count
| eval count=case(count!=0,count)

This will fill count values as NULL and hence the visualization will color NULL with BLACK color.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...