All Apps and Add-ons

How to combine my two search results of a chart and rangemap over time with display icons?

Contributor

I have two search results:
1. I have a table with list of values for products over a time range
2. I have a table with list of values plotted over field counts and uses range map.

I want to combine these two into a single view that shows time range on top and the values in the cells of the table, and then have it show colored marks for particular ranges.

any suggestions...

Example:

6/12/2015   7/12/2015   8/12/2015

prod1 0 10 100
prod2 10 15 25
prod3 100 0 100
alt text

0 Karma
1 Solution

Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

View solution in original post

Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

View solution in original post

Contributor

The problem is not in the color . merging the content of two tables.
i..e one table has time range as x-axis and the other has fields

basically I want to merge the output of the below two:

sourcetype=File* ID=* | dedup ID | stats count by ID| rangemap field=count low=0-100 elevated=101-1000

and

sourcetype=File* ID=* | dedup ID | bucket span=1h _time | eval formatted_time=strftime(_time, "%c") | chart count over ID  by formatted_time
0 Karma

Contributor

I got to a partial solution to this issue as below:
eventtype="Myevent" source="Mysource" ID=* | dedup ID | transaction ID | bin span=1d _time | eval formatted_time=strftime(_time, "%c") | eval Status="Pass" | chart values(Status) over ID by formatted_time

similarly I used other fields to plot required values.
coloring is the only challenge I have now .

0 Karma