All Apps and Add-ons

How to combine my two search results of a chart and rangemap over time with display icons?

bkumarm
Contributor

I have two search results:
1. I have a table with list of values for products over a time range
2. I have a table with list of values plotted over field counts and uses range map.

I want to combine these two into a single view that shows time range on top and the values in the cells of the table, and then have it show colored marks for particular ranges.

any suggestions...

Example:

6/12/2015   7/12/2015   8/12/2015

prod1 0 10 100
prod2 10 15 25
prod3 100 0 100
alt text

0 Karma
1 Solution

sundareshr
Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

View solution in original post

sundareshr
Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

bkumarm
Contributor

The problem is not in the color . merging the content of two tables.
i..e one table has time range as x-axis and the other has fields

basically I want to merge the output of the below two:

sourcetype=File* ID=* | dedup ID | stats count by ID| rangemap field=count low=0-100 elevated=101-1000

and

sourcetype=File* ID=* | dedup ID | bucket span=1h _time | eval formatted_time=strftime(_time, "%c") | chart count over ID  by formatted_time
0 Karma

bkumarm
Contributor

I got to a partial solution to this issue as below:
eventtype="Myevent" source="Mysource" ID=* | dedup ID | transaction ID | bin span=1d _time | eval formatted_time=strftime(_time, "%c") | eval Status="Pass" | chart values(Status) over ID by formatted_time

similarly I used other fields to plot required values.
coloring is the only challenge I have now .

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...