All Apps and Add-ons

Will you share your examples of radar chart visualizations with some indexed data?


I am looking for examples on Custom Radar Chart visualization. The example on download page of SplunkBase shows some evals with static key values. Let's imagine that I have an index with these few details:

SourceIP, DestIP, protocol - pretty much purely non-numerical values.

Can you give an example how to attach those on chart visualization as keys being evaluated? Obviously I need to have them as counts (like amount of SourceIP's and so on) - how would you add them as evaluated keys?

This is the example on SplunkBase:

| makeresults 
| eval key="current", "Business Value"=.37, Enablement=8.64, Foundations=2.56, Governance=1.68, "Operational Excellence"=4.992, "Community"=9.66 
| untable key,"axis","value" 
| eval keyColor="magenta"

Let's take SourceIP - I do have 5 of them on the list, DestIP's (there are 3) and protocol - well its either UDP or TCP, but count of each matter. How would you add them on the example to make it work?

In addition - is there a possibility to have, for example, eval key="CURRENT", then "PAST" and then "OBJECTIVE" - Per what I've tested, I am only able to have 2 evaluations on same chart.

Thanks in advance!

0 Karma