All Apps and Add-ons

How to animate more data points per time point in Geo Heatmap Custom Visualization animation?

sebastianstruwe
Explorer

Hi splunkers,

Is there a way to animate more than one data point per time point? For example:
t represents time point
x represents longitude
y represents latitude

t | x  |  y |  value
1|25|42 |31
1|32|51 |28
1|12|52 |30
2|13|31 |24
2|17|35 |20

At the moment only this animation is possible:

t | x |  y |  value
1|25|42 |31
2|13|31 |24

If you take a look at the heatmap.js plugin page, it should be possible (https://www.patrick-wied.at/static/heatmapjs/example-heatmap-animation.html).

So my goal is to get an animated heatmap and not just an animated point.
Does anyone have an idea?

Best,
Sebastian

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

So you want a heatmap that you can run through time in an animation like the example you provided, but the animation that is possible only does a single value across the whole heat map at this point? Can you provide the search that got you the data that you say is possible, including the heatmap visualization you can use? Also if you can get the data in a search like you want, can you provide some more information about that search?

0 Karma

sebastianstruwe
Explorer

So you want a heatmap that you can run through time in an animation like the example you provided, but the animation that is possible only does a single value across the whole heat map at this point?
Yes, that's the problem!

I'm using the Geo Heatmap Custom Visualization (3217) app. The basic search isn't the problem, it's more the documentation of the animated visualisation. I'm able to build a animated heatmap with one data point per time point, but if I use two, it doesn't work. Also if I use mvzip...
Last but not least I couldn't find any example with more than one data point per time point.

Best,
Sebastian

0 Karma

nplamondon
SplunkTrust
SplunkTrust

I'm not sure about the plugin, but you can generate a multivalue "point" list by time with mvzip.

...
| stats values(x) as lon values(y) as lat values(value) as val by t
| eval location=mvzip(lon, lat)
| eval point=mvzip(location, val)

alt text

sebastianstruwe
Explorer

Hi nplamondon,

thanks for your reply, but unfortunately this doesn't work for the app. I think the app is only made to show one data point per time point...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...