I have a list of companies that report errors to me and I would like to track how many errors each company is experiancing. I would like to have a map visualization that could show each company as their own bubble. I would also like the bubbles to be color coded by their range of errors.
For example, any company that reports less than 100 errors would be green; between 100-300 yellow and 300+ red.
I have tried:
index=custstats | stats sum(Errors) as CompanyError by CustNo | geostats latfield=lat longfield=long sum(Errors)
but this returns no results. I'm not sure how to make this work.
@kelseycasco try one of the following answers of mine and see whether it fits the need.
Also your query should have been
index=custstats | stats sum(Errors) as CompanyError by CustNo | lookup ..................................... ---> To fetch Latitude and Longitude fields for Customer Number. | geostats latfield=lat longfield=long sum(CompanyError)
I can't seem to fine the answer in those posts. I would like to set the colors based off of something like
if sum(errors)<100 cluster=green; if sum(errors)<300 cluster=yellow; if sum(errors)>300 cluster=red. The idea is that I can see the map of all my companies/customers and quickly see which ones are sending back the most errors or at least visualize their status.