Dashboards & Visualizations

Help with a Heatmap

New Member

Hi - I have a query as below

index=xxx "Project Id"

| rex field=_raw "Project\s*Id\s*-\s*(?<ProjectID>\d+)"

| eval eventTime=strftime(_time, "%m/%d/%Y  %H:%H:%S") 

| table eventime ProjectId


It presents the table perfect - basically when a Project does anything on the system.

I would like a heatmap if possible - when I select the one built in - it just shows the highest project ID Number - I would like an heatmap of the time I guess so I know when the system is being used.

The other thing is when I do a visualization - lets say the Project ID is 2000 - it shows as 2,000 in the Bar chart or any other chart. 

Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!