Hi!
I am looking for examples on Custom Radar Chart visualization. The example on download page of SplunkBase shows some evals with static key values. Let's imagine that I have an index with these few details:
SourceIP, DestIP, protocol - pretty much purely non-numerical values.
Can you give an example how to attach those on chart visualization as keys being evaluated? Obviously I need to have them as counts (like amount of SourceIP's and so on) - how would you add them as evaluated keys?
This is the example on SplunkBase:
| makeresults
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66
| untable key,"axis","value"
| eval keyColor="magenta"
Let's take SourceIP - I do have 5 of them on the list, DestIP's (there are 3) and protocol - well its either UDP or TCP, but count of each matter. How would you add them on the example to make it work?
In addition - is there a possibility to have, for example, eval key="CURRENT", then "PAST" and then "OBJECTIVE" - Per what I've tested, I am only able to have 2 evaluations on same chart.
Thanks in advance!
