I have a dashboard where I have attempted to create heat maps based on a range. The problem I have is that I have multiple Splunk servers I am deploying in different environments that are all different sizes; hence, I can't use the same number range for heat mapping on all of my systems because of the size differences.
What I would like to know is if it is possible to set heat map ranges based on percentages rather than hard numbers (e.g. stay green if < 1%, turn yellow if > 5% and turn red at 10%).
Heres an example by using the coropleth map, I hope this helps:
index=foo
| eventstats count as total
| iplocation src_ip
| stats count by Country, total
| eval percentage=round((count/total)*100, 2)
| fields Country, percentage
| eval percentage=case(percentage<10,"<10%",percentage<20,"10-20%", percentage<30,"20-30%", percentage<40,"30-40%", percentage<50,"40-50%", percentage<60,"50-60%", percentage<70,"60-70%", percentage<80,"70-80%", percentage<80,"80-90%", percentage<100,"90-100%")
| geom geo_countries featureIdField=Country