Dashboards & Visualizations

DIfferent color markers on Clustermap for different status values

sanshy01
Engager

I am nw to splunk. I have a requirement to print different color dots for different status values for that count.
I have the following query which prints out pie chart, which is not the one I want. I want Green, BLue and Orange dots different status on the same map without the pie chart. Any Help appreciated. Thanks

| spath output=status path="data.irc"
 | where status  in (001,000,002,003) 
 | spath output=activity path="data.txnClassifier" 
 | where activity in ("ACTIVE","PASSIVE","PENDING")
 | spath output=latitude path="data.lat"  
 | spath output=longitude path="data.lng"
 | geostats latfield=latitude longfield = longitude count by activity. 
Tags (2)
0 Karma

niketn
Legend

@sanshy01, Please try out Clustered Single Value Map Visualization or Location Tracker Custom Visualization based on your use case and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sanshy01
Engager

I tried the Clustered Single Map Visualization, it works but the refresh flickers a lot and refreshing is not smooth, and I do not so many points per second. The Tracker does not meet the requirements that I have.

Any suggestions?

0 Karma

sanshy01
Engager

Thanks @niketnilay, do these references are the app that I need to install, can I install this in Splunk cloud?

0 Karma

niketn
Legend

@sanshy01, You might have to reach out to Splunk Support for that. Meanwhile you should first test this in your POC or Dev/Test instance to ensure that it will satisfy the need. Location Tracker Custom Visualization is built by Splunk. Clustured Single Value Visualization is not built by Splunk but it supports a lot of customization.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...