Hi - I have a query as below index=xxx "Project Id" | rex field=_raw "Project\s*Id\s*-\s*(?<ProjectID>\d+)" | eval eventTime=strftime(_time, "%m/%d/%Y %H:%H:%S") | table eventime ProjectId It presents the table perfect - basically when a Project does anything on the system. I would like a heatmap if possible - when I select the one built in - it just shows the highest project ID Number - I would like an heatmap of the time I guess so I know when the system is being used. The other thing is when I do a visualization - lets say the Project ID is 2000 - it shows as 2,000 in the Bar chart or any other chart.
... View more