Hello, I was wondering if anyone could help me with this simple problem- I'm trying to graph the total amount of good calls, bad calls, as well as their fail rate percentages to show up on a chart. So far I've been able to chart the sums of good calls and bad calls according to the respective 'channel' that they were on, but the Fail_Rate percentage field that I've tried to define doesn't seem to be working out.   I've tried a few different methods of trying to plot the Fail_Rate but at this point I'm questioning whether or not I've defined the field correctly       source="C:\\Call_logs" termcodeID=1 OR termcodeID=34 OR termcodeID=7 OR termcodeID=9 OR termcodeID=21 OR termcodeID=27 OR termcodeID=30 OR termcodeID=32 OR termcodeID=34 ChanID!=0 | eval Good=if(termcodeID=1,"Good", "Bad") | eventstats count(termcodeID) as totalcalls | eval Fail_Rate=sum((Bad/totalcalls)*100,1) | chart count over ChanID by Good       ... View more

I'm currently working on a project that maps different events at different times in different service areas, and so far I've had a lot of luck with geostats. I'm fairly new to Splunk, SQL and XML but have been able to do a lot on my own. I have two questions: 1. Each event that is accumulated in the geostats map has a value assigned to it (between 0 and 7) in a particular field. Is there a way for me to assign a color to each value? I want to be able to look at the map and be able to discern between these different values. 2. I also created a table with these values with the Lat, Long, Time and Value [the 0-7] but I want to be able to link it to my geostats map. Is there a way that one could highlight/reveal the plot point, either when hovering over a row or clicking on it within the table? I'll number and post both search strings: 1. Geostats map:       source="e:\\folder" | rex field=_raw "longitude:(?<long>.*) latitude:(?<lat>.*)" | rex field=_raw "value_id:(?<Value>.*)" | rex field="date_hour" "(?P<Time>[^\s]+)" | search long!="null"| search lat>"0" | eval n=tonumber(long)| eval n=tonumber(lat) | eval lat=printf("%.*f", 8, lat) | eval long=printf("%.*f", 8, long) | eval Time=strftime(_time, "%b-%d %H:%M:%S.%Q") | geostats count longfield=long latfield=lat translatetoxy=true maxzoomlevel=10       2. Table:       source="e:\\folder" | rex field=_raw "longitude:(?<long>.*) latitude:(?<lat>.*)"| rex field=_raw "value_id:(?<Value>.*)" | rex field="date_hour" "(?P<Time>[^\s]+)" | search long!="null"| search lat>"0"| eval n=tonumber(long)| eval n=tonumber(lat) | eval n=tonumber(Value)| eval long=long*-180/pow(2, 23) | eval lat=lat*90/pow(2, 23) | eval lat=printf("%.*f", 8, lat)| eval Balue=printf("%.1s",Value) | eval long=printf("%.*f", 8, long) | eval Time=strftime(_time, "%b-%d %H:%M:%S.%Q") | table lat, long, Time, Value       Also if anyone has any criticism to how I can clean this up let me know. Again, I'm fairly new to this. Thanks! ... View more