All Apps and Add-ons

Can you hard code a color for a value range in Calendar Heat Map?



I've got an issue where I need to display multiple years for the Calendar Heat Map however it appears to have a limit of 12 months.

That is fine I can just have a panel for each year with this search

index=`my_index` sourcetype=bluecoat_importer_queue_status section=queue_status subsection=dump 
| dedup filename
| eval _time = date_timestamp
| eval start_of_year = strptime("2017-01-01","%Y-%m-%d")
| eval end_of_year = strptime("2018-01-01","%Y-%m-%d")
| where _time > start_of_year AND _time < end_of_year
| eval status = case (queue=="splunk_completed",100,queue_status=="pending",50,queue_status=="in_progress",50,queue_status=="processing",50,1==1,0)
| table _time filename queue queue_status status 
| timechart span=1d max(status) as status
| search status=*

Note how status gets set to 0, 50 or 100. Where I plan to have

  • 0 = red
  • 50 = orange or brown
  • 100 = green

Problem is the 2017 year doesn't have any results that contain 100 so the auto colour pickers picks a different set of colours. Note green for 2017 should be brown.

alt text

Is there any way for me to hardcode these colour ranges or values so I can keep consistency between years?


Any luck with this?

0 Karma


Still no one has answers for this ? I guess it's not in this viz's roadmap ?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...