Dashboards & Visualizations

DIfferent color markers on Clustermap for different status values

sanshy01
Engager

I am nw to splunk. I have a requirement to print different color dots for different status values for that count.
I have the following query which prints out pie chart, which is not the one I want. I want Green, BLue and Orange dots different status on the same map without the pie chart. Any Help appreciated. Thanks

| spath output=status path="data.irc"
 | where status  in (001,000,002,003) 
 | spath output=activity path="data.txnClassifier" 
 | where activity in ("ACTIVE","PASSIVE","PENDING")
 | spath output=latitude path="data.lat"  
 | spath output=longitude path="data.lng"
 | geostats latfield=latitude longfield = longitude count by activity. 
Tags (2)
0 Karma

niketn
Legend

@sanshy01, Please try out Clustered Single Value Map Visualization or Location Tracker Custom Visualization based on your use case and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sanshy01
Engager

I tried the Clustered Single Map Visualization, it works but the refresh flickers a lot and refreshing is not smooth, and I do not so many points per second. The Tracker does not meet the requirements that I have.

Any suggestions?

0 Karma

sanshy01
Engager

Thanks @niketnilay, do these references are the app that I need to install, can I install this in Splunk cloud?

0 Karma

niketn
Legend

@sanshy01, You might have to reach out to Splunk Support for that. Meanwhile you should first test this in your POC or Dev/Test instance to ensure that it will satisfy the need. Location Tracker Custom Visualization is built by Splunk. Clustured Single Value Visualization is not built by Splunk but it supports a lot of customization.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...