Thanks niketnilay for quick response I've already tried the transpose but does not produce the desired result, maybe I should go with the other option you've suggested. ... View more

Hi shankarananth my question is if there is another Heat map custom visualization aside from the Heatmap Custom Visualization on the Splunk base sorry for the confusion, but anyway I've already achieved what I wanted by using Treemap Custom Visualization. Thanks 🙂 ... View more

Thanks niketnilay, i tried the two visualization but its not applicable for the requirements, instead I used Treemap Custom Visualization. ... View more

Hi @niketnilay, What I want to do is to set fix color for each marker depending on the status, I am using two fields city (right side of the map marker) and status (left side of the map marker) that is why the map marker is divided into two colors using <option name="mapping.fieldColors">{"OK":"0x65a637","KO":"0xd93f3c"}</option> I am able to set fixed color for the status, if the status is OK the map marker will be green and if the status is KO it will be red but what I need to do is to set one color for the whole marker as of now this is the result: I need the city to inherit the color of the status and produce result like this : Is this possible? Best Regards, ... View more

Hi Niketnilay , I've tried the Choropleth map visualization but it does produce the same result i'm not able to inherit the color of the field or set one color for the marker. Thanks Niketnilay for answering BR, Lester ... View more

Ok thanks using, choropleth map will I be able to set one color for for a marker that contain two fields, for example the color of field2 depends on the color of field1, if the field1 value is "ok "the two fields will be colored green, re-posting the code I used. | eval status = if (isnotnull (Type) ,"KO","OK") |eval status = "City: ".sitename .",". status |makemv status delim="," | table sitename ID status Latitudine Longitudine | geostats latfield=Latitudine longfield=Longitudine count by status</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>10m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="height">423</option> <option name="mapping.choroplethLayer.colorBins">3</option> <option name="mapping.choroplethLayer.colorMode">auto</option> <option name="mapping.choroplethLayer.maximumColor">0xe60026</option> <option name="mapping.choroplethLayer.minimumColor">0x6dc066</option> <option name="mapping.choroplethLayer.neutralPoint">0</option> <option name="mapping.choroplethLayer.shapeOpacity">0.75</option> <option name="mapping.choroplethLayer.showBorder">1</option> <option name="mapping.data.maxClusters">999</option> <option name="mapping.fieldColors">{OK:0x6dc066,KO:0xe60026}</option> ... View more

Hi Niketnilay, Thanks for your answer I've already used the mapping.fieldColors option, but what I need is for the City to inherit the color of the status for example if the color of the status part of the marker is green the city will inherit its color and will be green also making the whole marker to be colored as green , if the status part of the marker is red the city part of the marker will inherit its color and will be red also making the whole marker to be colored as red, is it possible? below is the xml of the dashboard | eval status = if (isnotnull (Type) ,"KO","OK") |eval status = "City: ".sitename .",". status |makemv status delim="," | table sitename ID status Latitudine Longitudine | geostats latfield=Latitudine longfield=Longitudine count by status $field1.earliest$ $field1.latest$ 1 10m delay none 423 3 auto 0xe60026 0x6dc066 0 0.75 1 999 {OK:0x6dc066,KO:0xe60026} ... View more

it will be dynamic based on which pie in the Cluster map is being hovered ... View more

Thanks for the help 🙂 ... View more

It helps thanks 🙂 ... View more

Thanks for answering, I've added interval = 5 it make event generation faster but it does not reach the 50k events per minute 🙂 ... View more

It is "A and B " ... View more

Thanks 🙂 , but what I want is to set a field value to a variable, for example "fieldname" contains "A" and "B", I want to create a new field named "output" and it will contain "B" (output= B) ... View more