Splunk Search

Scatter plot with text values and colour

alex_collins_in
New Member

I'm trying to plot the following as a scatter chart:

  • The y-axis should be the namespace. Namespace is a small set of strings, e.g. "default", "argo" or "kube-system".
  • The x-axis is time.
  • Each point should be coloured either green or red depending on whether or not the workflow succeeded or failed.

Problem 1 - you cannot have non-numeric x and y axis. Time does not appear to be numeric. So how do I convert my namespace to a number? I think it should be 0..N based on it's index is the values that namespace can be.

Problem 2 - how to colour points?

This is how far I have gotten so far:

index=foo sourcetype=eventrouter host="event-router-*" source="foo/*" event.involvedObject.kind=Workflow (event.reason=WorkflowSucceeded OR event.reason=WorkflowFailed) | convert num(_time) as x | table event.metadata.namespace x event.reason

 

Labels (1)
0 Karma

Random_Walk
Path Finder

Hi @Anonymous ,

To map the namespace to a number you can use an eval case like:

| eval NameIndex=case(NameSpace=="default",0, NameSpace=="argo",1, NameSpace=="kube-system",2, NameSpace=="AWS",3)

The scatterplot colouring I'm not so sure, most of the charts have colour values in the XML, but I've not played with scatterplots.

 

Kind Regards,

R.

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...