Help with a Heatmap - Splunk Community

Dashboards & Visualizations

Hi - I have a query as below

index=xxx "Project Id"

| rex field=_raw "Project\s*Id\s*-\s*(?<ProjectID>\d+)"

| eval eventTime=strftime(_time, "%m/%d/%Y %H:%H:%S")

| table eventime ProjectId

It presents the table perfect - basically when a Project does anything on the system.

I would like a heatmap if possible - when I select the one built in - it just shows the highest project ID Number - I would like an heatmap of the time I guess so I know when the system is being used.

The other thing is when I do a visualization - lets say the Project ID is 2000 - it shows as 2,000 in the Bar chart or any other chart.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...