Hi,
I've got an issue where I need to display multiple years for the Calendar Heat Map however it appears to have a limit of 12 months.
That is fine I can just have a panel for each year with this search
index=`my_index` sourcetype=bluecoat_importer_queue_status section=queue_status subsection=dump
| dedup filename
| eval _time = date_timestamp
| eval start_of_year = strptime("2017-01-01","%Y-%m-%d")
| eval end_of_year = strptime("2018-01-01","%Y-%m-%d")
| where _time > start_of_year AND _time < end_of_year
| eval status = case (queue=="splunk_completed",100,queue_status=="pending",50,queue_status=="in_progress",50,queue_status=="processing",50,1==1,0)
| table _time filename queue queue_status status
| timechart span=1d max(status) as status
| search status=*
Note how status gets set to 0, 50 or 100. Where I plan to have
- 0 = red
- 50 = orange or brown
- 100 = green
Problem is the 2017 year doesn't have any results that contain 100 so the auto colour pickers picks a different set of colours. Note green for 2017 should be brown.
Is there any way for me to hardcode these colour ranges or values so I can keep consistency between years?
