All Apps and Add-ons

How to combine my two search results of a chart and rangemap over time with display icons?

bkumarm
Contributor

I have two search results:
1. I have a table with list of values for products over a time range
2. I have a table with list of values plotted over field counts and uses range map.

I want to combine these two into a single view that shows time range on top and the values in the cells of the table, and then have it show colored marks for particular ranges.

any suggestions...

Example:

6/12/2015   7/12/2015   8/12/2015

prod1 0 10 100
prod2 10 15 25
prod3 100 0 100
alt text

0 Karma
1 Solution

sundareshr
Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

View solution in original post

sundareshr
Legend

Look at this answered question. Let me know if this doesn't work for you

https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

bkumarm
Contributor

The problem is not in the color . merging the content of two tables.
i..e one table has time range as x-axis and the other has fields

basically I want to merge the output of the below two:

sourcetype=File* ID=* | dedup ID | stats count by ID| rangemap field=count low=0-100 elevated=101-1000

and

sourcetype=File* ID=* | dedup ID | bucket span=1h _time | eval formatted_time=strftime(_time, "%c") | chart count over ID  by formatted_time
0 Karma

bkumarm
Contributor

I got to a partial solution to this issue as below:
eventtype="Myevent" source="Mysource" ID=* | dedup ID | transaction ID | bin span=1d _time | eval formatted_time=strftime(_time, "%c") | eval Status="Pass" | chart values(Status) over ID by formatted_time

similarly I used other fields to plot required values.
coloring is the only challenge I have now .

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...