All Apps and Add-ons

How to combine my two search results of a chart and rangemap over time with display icons?

bkumarm
Contributor

I have two search results:
1. I have a table with list of values for products over a time range
2. I have a table with list of values plotted over field counts and uses range map.

I want to combine these two into a single view that shows time range on top and the values in the cells of the table, and then have it show colored marks for particular ranges.

any suggestions...

Example:

6/12/2015   7/12/2015   8/12/2015

prod1 0 10 100
prod2 10 15 25
prod3 100 0 100
alt text

0 Karma
1 Solution

sundareshr
Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

View solution in original post

sundareshr
Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

bkumarm
Contributor

The problem is not in the color . merging the content of two tables.
i..e one table has time range as x-axis and the other has fields

basically I want to merge the output of the below two:

sourcetype=File* ID=* | dedup ID | stats count by ID| rangemap field=count low=0-100 elevated=101-1000

and

sourcetype=File* ID=* | dedup ID | bucket span=1h _time | eval formatted_time=strftime(_time, "%c") | chart count over ID  by formatted_time
0 Karma

bkumarm
Contributor

I got to a partial solution to this issue as below:
eventtype="Myevent" source="Mysource" ID=* | dedup ID | transaction ID | bin span=1d _time | eval formatted_time=strftime(_time, "%c") | eval Status="Pass" | chart values(Status) over ID by formatted_time

similarly I used other fields to plot required values.
coloring is the only challenge I have now .

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...