topic Re: help on heat_map_visualization in Dashboards & Visualizations

help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 06:58:41 GMT

i need to do an heat map vizualization

i have checked the dasbord examples addon and in this example a lookup is used

| inputlookup sample-data.csv

is it possible to do the same thing without a lookup please? I mean by using an index and an eval command

for example if the field "Value" is < 50 th color is green, <30, the color is orange and < 10 the color is red in my heat map

Rgds

Re: help on heat_map_visualization

ITWhisperer — Fri, 13 Sep 2024 07:48:27 GMT

SPL 101 - each search needs a set of events to work with, inputlookup is one way of getting them, replacing this with an index search is another, so, yes, there are a number of ways to do the same thing without inputlookup!

Re: help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 07:57:28 GMT

could you please give me an example?

Re: help on heat_map_visualization

ITWhisperer — Fri, 13 Sep 2024 08:23:07 GMT

Here is an example of a user using index to generate some events at the beginning of a search

https://community.splunk.com/t5/Splunk-Enterprise/help-on-append-command-in-a-line-chart/m-p/676700#M18608

Re: help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 08:41:57 GMT

Not sure you understand my needs In the example below you can see thats random numbers are displayed | gentimes start=-10 increment=4h | eval "Server Availability"=random()%100, "Customer Satisfaction"=random()%100,"Server Performance"=random()%100, _time=starttime | table _time, "Server Availability","Customer Satisfaction","Server Performance" Instead random numbers, i would like to have true numbers froms my index, for example from the field "Value" so i dont know how to query on it in the example i gave to you

Re: help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 08:43:58 GMT

Re: help on heat_map_visualization

ITWhisperer — Fri, 13 Sep 2024 09:03:38 GMT

So, instead of using gentimes to generate events, use an index search (as you would normally do)

Re: help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 09:22:46 GMT

its what I am doing but it returns no heat map

index="main" sourcetype="Perfmon:disk" | eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart eval(round(avg(Value),0)) by host

instead this which returns an heat map

| inputlookup sample-data.csv | eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart eval(round(avg(value),0)) by name

Re: help on heat_map_visualization

ITWhisperer — Fri, 13 Sep 2024 10:20:07 GMT

You should understand what your data is not blindly copy other searches and expect them to work on different data!

Your data probably already has the _time field with valid data (although I am guessing here as (yet again) you haven't shared your events (as has been suggested many times before!) - try this

index="main" sourcetype="Perfmon:disk" | timechart eval(round(avg(Value),0)) by host

If it doesn't work, may I suggest you provide more information such as the event you have in your index?

Re: help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 10:37:50 GMT

I dont know why but the fields "Value" displays anything when i execute your search even if the field exists

Re: help on heat_map_visualization

jip31 — Fri, 13 Sep 2024 10:49:00 GMT

now it works...

Last question : how to change the rangemap of the colors

It iis in the xml or is it automatic?