All Apps and Add-ons

Status Matrix Custom Viz Documentation and Scaling Radius

loren3737
Explorer

There doesn't seem to be any documentation for how to use this application. I am interested in applying the scaling radius feature but I don't see an explanation of how to use it. Any insights would be appreciated.

0 Karma
1 Solution

niketn
Legend

@loren3737 can you please try the following example. Status 0 and 1 are used to show incomplete (red) or complete (in green). Duration in minute is used as radius for Circles for the Status Matrix custom visualization. (PS: Radius value can be between 1 to 26).

alt text

Following is the run anywhere dashboard example Simple XML code:

<dashboard>
  <label>Status Matrix Custom Visualization</label>
  <row>
    <panel>
      <viz type="cuviz_status_matrix.status_matrix">
        <search>
          <query>| makeresults 
| eval data="1,1,1,0;10,5,15,5" 
| makemv data delim=";" 
| streamstats count as column 
| mvexpand data 
| makemv data delim="," 
| eval addtocart=mvindex(data,0), ordered=mvindex(data,1), shipped=mvindex(data,2), delivered=mvindex(data,3) 
| table ordernum addtocart ordered shipped delivered 
| transpose header_field=column 
| rename "row 1" as "order1_status", "row 2" as "order1_duration"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="cuviz_status_matrix.status_matrix.after_label">(mins)</option>
        <option name="cuviz_status_matrix.status_matrix.before_label">Duration:</option>
        <option name="cuviz_status_matrix.status_matrix.enable_scalable_radius">true</option>
        <option name="cuviz_status_matrix.status_matrix.max_radius">15</option>
        <option name="cuviz_status_matrix.status_matrix.min_radius">5</option>
        <option name="cuviz_status_matrix.status_matrix.radius">15</option>
        <option name="cuviz_status_matrix.status_matrix.show_flaky_metrics">false</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

jzhang_splunk
Splunk Employee
Splunk Employee

There is the sample test data in the release note. Save it to csv file and get it indexed into splunk.
build_no,case1,case2,case3,radius1,radius2,radius3
467,1,1,0,2,4,2
468,1,1,0,2,4,2
469,,1,0,3,5,3
470,0,1,,3,5,3
471,,1,1,4,4,4
472,0,0,1,4,4,4

Then run SPL: index=xxxx | table build_no case1 radius1 | sort build_no

niketn
Legend

@loren3737 can you please try the following example. Status 0 and 1 are used to show incomplete (red) or complete (in green). Duration in minute is used as radius for Circles for the Status Matrix custom visualization. (PS: Radius value can be between 1 to 26).

alt text

Following is the run anywhere dashboard example Simple XML code:

<dashboard>
  <label>Status Matrix Custom Visualization</label>
  <row>
    <panel>
      <viz type="cuviz_status_matrix.status_matrix">
        <search>
          <query>| makeresults 
| eval data="1,1,1,0;10,5,15,5" 
| makemv data delim=";" 
| streamstats count as column 
| mvexpand data 
| makemv data delim="," 
| eval addtocart=mvindex(data,0), ordered=mvindex(data,1), shipped=mvindex(data,2), delivered=mvindex(data,3) 
| table ordernum addtocart ordered shipped delivered 
| transpose header_field=column 
| rename "row 1" as "order1_status", "row 2" as "order1_duration"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="cuviz_status_matrix.status_matrix.after_label">(mins)</option>
        <option name="cuviz_status_matrix.status_matrix.before_label">Duration:</option>
        <option name="cuviz_status_matrix.status_matrix.enable_scalable_radius">true</option>
        <option name="cuviz_status_matrix.status_matrix.max_radius">15</option>
        <option name="cuviz_status_matrix.status_matrix.min_radius">5</option>
        <option name="cuviz_status_matrix.status_matrix.radius">15</option>
        <option name="cuviz_status_matrix.status_matrix.show_flaky_metrics">false</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

loren3737
Explorer

Thanks, this is what I was looking for. This is a very helpful example. The only thing that I'm still unsure about is how to have radius values that represent the duration of how long a certain case has remained the same. I have values of 1/0 for online/offline.

My current search takes care of all of the cases but how would I append the data of how long it has been since they changed?

BaseSearch |
| eval {rtu}=case(state LIKE "online",1,state LIKE "offline",0,state LIKE "unknown",0,state LIKE "failed",0)
| eval side="Status"
| fields - _time rtu state path
| stats values(*) as * by side

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...