- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- calendar heatmap viz force value=0 different color...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to force one of the color bins to be for 0 value? Or some other splunk ninja magic to gray out those days on the calendar heatmap? The data has high spikes and many 0s. | timechart span=1d limit=0 count by status. I have some days with low values that get colored the same as 0. Splunk 6.6.2. Thanks for any suggestions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nulls are black instead of being colored. if you can force your zero's to be nulls or maybe only return data that is greater than zero your zeros will become null?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nulls are black instead of being colored. if you can force your zero's to be nulls or maybe only return data that is greater than zero your zeros will become null?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You saved my time, thanks !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This works, but has an unexpected bug (seemingly) --- for null values between the current date and the most-recent event, the boxes are colored grey rather than black.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually, I used only search count>0 and it did what I was looking for
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes! That did it! Search count>0 rather than converting to null, and the viz shows 0-counts as grey.
Perfect!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Adding to @kmaron's point try the following run anywhere search with Calendar Heat Map visualization:
index=_internal sourcetype=splunkd log_level!=INFO
| timechart count
| eval count=case(count!=0,count)
This will fill count values as NULL and hence the visualization will color NULL with BLACK color.
| makeresults | eval message= "Happy Splunking!!!"
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
Adoption of RUM and APM at Splunk
