Splunk Search

use the heat map option and highlight the max and min per each column.

HattrickNZ
Motivator

hi there

THis is my sample data. I want to use the heat map option and highlight the max and min per each column.
So I would have 2 values highlighted in each column, the max and the min.
Can this be done in Splunk 7.3.1?

| makeresults 
      | eval data = "
 1    10;
 2    9;
 3    8;
 4    7;
 5    6;
 6    5;
 7    4;
 8    3;
 9    2;
 10   1;
     " 
      | makemv delim=";" data
      | mvexpand data
      | rex field=data "(?<Date>\d+)\s+(?<Y>\d+)"
      | fields + Date Y | fields - _time
      |search Y = * | 
      chart count(Y) by Y | sort + Y

this is what I get just using the default setting.

![heat map example][1]

similar question asked here before
https://answers.splunk.com/answers/116018/splunk-6-simple-xml-dataoverlaymode-on-table-can-we-specif...

Tags (3)
0 Karma

niketn
Legend

@HattrickNZ I have posted an answer to @somesoni2 's question posted above. https://answers.splunk.com/answers/116018/splunk-6-simple-xml-dataoverlaymode-on-table-can-we-specif...

alt text

Please refer to one of my older answer on similar lines which also explains both approaches: https://answers.splunk.com/answers/686288/how-do-you-highlight-a-table-cell-based-on-a-field.html

Do upvote the other answers if you find them useful!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...