topic Re: Heatmap in Dashboard in Dashboards & Visualizations

Heatmap in Dashboard

kmattern — Sat, 01 May 2010 01:53:22 GMT

I have a data table panel on a dashboard withthe following search:

sourcetype="PubsCounts-too_small" * |fields account received, authorized, Difference |eval Difference= (authorized-received) | chart values(Difference) as Difference by account

It displays well except that I would like to have a heatmap on the difference column. If I view the results, I can use the heatmap to great effect.

How can I use a heatmap in this search on the dashboard? BTW: It is an inline search.

Re: Heatmap in Dashboard

sideview — Sat, 01 May 2010 09:02:17 GMT

The simplified XML dashboards dont have this ability - you cant do it from the editing UI that you see, nor from editing the simplified XML source.

However the entire simplified XML is just a shortcut layer to the advanced XML syntax. And in the advanced xml this is relatively easy to do.

Converting from the simplified XML to the advanced XML is briefly discussed on this page http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard

however here are the individual steps spelled out:

load your working (simplified XML) view in the browser
tack ?showsource=1 onto the end of the URL
you'll be in a weird page. scroll down. you'll see a huge textarea field full of XML. Copy it into your clipboard
back to your working view.
Actions > edit dashboard
click the little blue link 'Edit name/xml'.
in the form that loads, paste the big nasty advanced xml in there.

converting from a simplified dashboard brings a bunch of weird cruft into the advanced world, but it'll work fine.

Once its converted, getting your heatmap is simply a matter of: finding this line:

<module name="SimpleResultsTable">

and inside that module, ie right under that line, put

  <param name="dataOverlayMode">heatmap</param>

Re: Heatmap in Dashboard

kmattern — Mon, 10 May 2010 22:36:54 GMT

Nick,

I'm using 4.0.10 at present and showsource does not give me any XML. What other options do I have to either generate advanced XML or to get the heatmap some other way?

Ken

Re: Heatmap in Dashboard

sideview — Tue, 11 May 2010 00:05:02 GMT

I see. 😃 Well honestly the path of least resistance is probably to install a copy of 4.1 on your laptop briefly, copy over the simplified XML view, and use its showsource=1 to do the conversion and then copy the result back to your instance.

Re: Heatmap in Dashboard

khourihan_splun — Tue, 06 May 2014 17:54:03 GMT

In Splunk 6.x, you can just edit the dashboard panels and click on the paintbrush icon and select the "heat map" data overlay.

Re: Heatmap in Dashboard

email2vamsi — Fri, 21 Apr 2017 12:31:56 GMT

Are you referring to the paintbrush icon on the Table header? or some other place?