Dashboards & Visualizations

Status Matrix Custom Viz is not working as expected

gs
Engager

I have installed Status Matrix Custom Viz on my stand-alone search head, radius part is not working as expected. Your help would be highly appreciable.

Labels (2)
0 Karma

gs
Engager

@niketn  I have seen your post earlier but the radius part is not working.. 
Please suggest me on this.
Thanks in advance!

 

0 Karma

niketn
Legend

@gs for the community to assist you better please provide more details on what do you mean by it is not working as expected. What is your use case? If you can add a screenshot of what is wrong vs what is expected and some sample data of what you are working with along with SPL/Simple XML code used would be great. Please mock/anonymize any sensitive information before posting.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gs
Engager

Status Matrix.PNGStatus Matrix.PNG

@niketn  SPL I used:
| makeresults
| eval data="1,1,1,0;10,5,15,5"
| makemv data delim=";"
| streamstats count as column
| mvexpand data
| makemv data delim=","
| eval addtocart=mvindex(data,0), ordered=mvindex(data,1), shipped=mvindex(data,2), delivered=mvindex(data,3)
| table ordernum addtocart ordered shipped delivered
| transpose header_field=column
| rename "row 1" as "order1_status", "row 2" as "order1_duration"

0 Karma

niketn
Legend

@gs  as per the example on Splunkbase you need to add radius column values for each metric you are trying to plot on Status Matrix. For example order_status and order_duration in your case need two additional columns for respective Radius to be plotted. Try following search instead:

| makeresults
| fields - _time
| eval data="addtocart,1,1,5,2;ordered,1,1,3,2;shipped,,1,10,7,;delivered,0,1,0,2;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval stage=mvindex(data,0),order_status=mvindex(data,1),order_duration=mvindex(data,2),order_status_radius=mvindex(data,3),order_duration_radius=mvindex(data,4)
| table stage order_status order_duration order_status_radius, order_duration_radius

  Following is a run anywhere example for you to try out!

Screen Shot 2020-09-30 at 10.51.33 PM.pngScreen Shot 2020-09-30 at 10.51.33 PM.png

 

<dashboard>
  <label>Status Matrix</label>
  <row>
    <panel>
      <viz type="cuviz_status_matrix.status_matrix">
        <search>
          <query>| makeresults
| fields - _time
| eval data="addtocart,1,1,5,2;ordered,1,1,3,2;shipped,,1,10,7,;delivered,0,1,0,2;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval stage=mvindex(data,0),order_status=mvindex(data,1),order_duration=mvindex(data,2),order_status_radius=mvindex(data,3),order_duration_radius=mvindex(data,4)
| table stage order_status order_duration order_status_radius, order_duration_radius</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="cuviz_status_matrix.status_matrix.before_label">Status</option>
        <option name="cuviz_status_matrix.status_matrix.enable_scalable_radius">true</option>
        <option name="cuviz_status_matrix.status_matrix.max_radius">26</option>
        <option name="cuviz_status_matrix.status_matrix.min_radius">10</option>
        <option name="cuviz_status_matrix.status_matrix.radius">24</option>
        <option name="cuviz_status_matrix.status_matrix.show_flaky_metrics">false</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </viz>
    </panel>
  </row>
</dashboard>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...