Dashboards & Visualizations

DIfferent color markers on Clustermap for different status values

sanshy01
Engager

I am nw to splunk. I have a requirement to print different color dots for different status values for that count.
I have the following query which prints out pie chart, which is not the one I want. I want Green, BLue and Orange dots different status on the same map without the pie chart. Any Help appreciated. Thanks

| spath output=status path="data.irc"
 | where status  in (001,000,002,003) 
 | spath output=activity path="data.txnClassifier" 
 | where activity in ("ACTIVE","PASSIVE","PENDING")
 | spath output=latitude path="data.lat"  
 | spath output=longitude path="data.lng"
 | geostats latfield=latitude longfield = longitude count by activity. 
Tags (2)
0 Karma

niketn
Legend

@sanshy01, Please try out Clustered Single Value Map Visualization or Location Tracker Custom Visualization based on your use case and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sanshy01
Engager

I tried the Clustered Single Map Visualization, it works but the refresh flickers a lot and refreshing is not smooth, and I do not so many points per second. The Tracker does not meet the requirements that I have.

Any suggestions?

0 Karma

sanshy01
Engager

Thanks @niketnilay, do these references are the app that I need to install, can I install this in Splunk cloud?

0 Karma

niketn
Legend

@sanshy01, You might have to reach out to Splunk Support for that. Meanwhile you should first test this in your POC or Dev/Test instance to ensure that it will satisfy the need. Location Tracker Custom Visualization is built by Splunk. Clustured Single Value Visualization is not built by Splunk but it supports a lot of customization.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...