All Apps and Add-ons

How To Create Heat Map time as X axis?

manikanthkoti
Loves-to-Learn Everything

Hi,
I have below a table with fields (hourTime, appName, Fail). This table tells you how many transactions are failed for the Particular application in that hour.

Please help me to create the heat map by using these fields as hourTime as X-Axis and appName as Y-Axis.

I am trying for "Heat Map Viz" please find the link(https://splunkbase.splunk.com/app/4460/#/details)

Please help me is there any better Visuvilizations also to Display this.

Please help me . Thank you very much in advance

alt text

0 Karma
1 Solution

to4kawa
Ultra Champion

Sample:

| makeresults count=2 
| streamstats count 
| eval _time=if(count=2,relative_time(_time,"-2d@d"),relative_time(_time,"-1d@d")) 
| makecontinuous _time span=5m 
| eval appName="APP_".(random() % 3 + 1), count = random() % 10 + 1 
| timechart span=1h sum(count) as count by appName

Hi , @manikanthkoti
hourTime is bad format.
Please provide your query. I'll fix it.

View solution in original post

0 Karma

to4kawa
Ultra Champion

Sample:

| makeresults count=2 
| streamstats count 
| eval _time=if(count=2,relative_time(_time,"-2d@d"),relative_time(_time,"-1d@d")) 
| makecontinuous _time span=5m 
| eval appName="APP_".(random() % 3 + 1), count = random() % 10 + 1 
| timechart span=1h sum(count) as count by appName

Hi , @manikanthkoti
hourTime is bad format.
Please provide your query. I'll fix it.

0 Karma

manikanthkoti
Loves-to-Learn Everything

Thank you very much I did the same thing now I am getting Visualizations but I need a colors based on appName, not by Fail.
Is there any way to change the color based on appName?

0 Karma

spavin
Path Finder

Hi Manikanthkoti,

Can you provide an example of coloring by appName? The heat map is designed to show variation in the data - in this case the count. Are you looking for static colors for each app?

0 Karma

to4kawa
Ultra Champion

sorry, I don't know.
option is nothing.
If you want to change the color based on appName, maybe you should create SplunkJS.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...