Splunk Search

How to display cities by color based on severity level in Splunk 6 maps and display city name and severity level in tooltip?

Venkat_16
Contributor

Hi. I am working on displaying cities with different severity levels. Cities with sev1 should be in red, sev2 in amber and sev3 in yellow. I also want to display city name and sev level in tooltip. I tried this solution:
http://answers.splunk.com/answers/137571/displaying-city-in-splunk-6-map-tooltip.html

But the issue is, all the cities are displayed in different colors. I want to display the city based on the color I specify. I have even inserted the color in map element xml view.{sev1:0xFF3300,sev2:0xFFCC66,sev3:0xFFFF66}. the query am using is...."

eval sev=case(units>=120,"sev1",units<120 AND units>=50,"sev2",units<25,"sev3") |  eval new_field=city.": ".sev | lookup cities.csv cityname as city OUTPUTNEW latitude,longitude| geostats globallimit=0 latfield=latitude longfield=longitude count by new_field"
0 Karma

richaGindodia
Path Finder

Hi Venkat, Did you find an answer to your question because i have similar requirement. Any pointers

0 Karma

mikaelbje
Motivator

I believe this question is a duplicate of http://answers.splunk.com/answers/106729/map-visualization-regex-for-mapping-fieldcolors.html

Try looking for the solution there. It involves using the xyseries command.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...