Status Matrix Custom Viz Documentation and Scaling Radius

[loren3737]

There doesn't seem to be any documentation for how to use this application. I am interested in applying the scaling radius feature but I don't see an explanation of how to use it. Any insights would be appreciated.

[jzhang_splunk]

There is the sample test data in the release note. Save it to csv file and get it indexed into splunk.
build_no,case1,case2,case3,radius1,radius2,radius3
467,1,1,0,2,4,2
468,1,1,0,2,4,2
469,,1,0,3,5,3
470,0,1,,3,5,3
471,,1,1,4,4,4
472,0,0,1,4,4,4

Then run SPL: index=xxxx | table build_no case1 radius1 | sort build_no

[niketn · Accepted solution]

@loren3737 can you please try the following example. Status 0 and 1 are used to show incomplete (red) or complete (in green). Duration in minute is used as radius for Circles for the Status Matrix custom visualization. (PS: Radius value can be between 1 to 26).

Following is the run anywhere dashboard example Simple XML code:

<dashboard>
  <label>Status Matrix Custom Visualization</label>
  <row>
    <panel>
      <viz type="cuviz_status_matrix.status_matrix">
        <search>
          <query>| makeresults 
| eval data="1,1,1,0;10,5,15,5" 
| makemv data delim=";" 
| streamstats count as column 
| mvexpand data 
| makemv data delim="," 
| eval addtocart=mvindex(data,0), ordered=mvindex(data,1), shipped=mvindex(data,2), delivered=mvindex(data,3) 
| table ordernum addtocart ordered shipped delivered 
| transpose header_field=column 
| rename "row 1" as "order1_status", "row 2" as "order1_duration"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="cuviz_status_matrix.status_matrix.after_label">(mins)</option>
        <option name="cuviz_status_matrix.status_matrix.before_label">Duration:</option>
        <option name="cuviz_status_matrix.status_matrix.enable_scalable_radius">true</option>
        <option name="cuviz_status_matrix.status_matrix.max_radius">15</option>
        <option name="cuviz_status_matrix.status_matrix.min_radius">5</option>
        <option name="cuviz_status_matrix.status_matrix.radius">15</option>
        <option name="cuviz_status_matrix.status_matrix.show_flaky_metrics">false</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

[loren3737]

Thanks, this is what I was looking for. This is a very helpful example. The only thing that I'm still unsure about is how to have radius values that represent the duration of how long a certain case has remained the same. I have values of 1/0 for online/offline.

My current search takes care of all of the cases but how would I append the data of how long it has been since they changed?

BaseSearch |
| eval {rtu}=case(state LIKE "online",1,state LIKE "offline",0,state LIKE "unknown",0,state LIKE "failed",0)
| eval side="Status"
| fields - _time rtu state path
| stats values(*) as * by side