|
I have a data table panel on a dashboard withthe following search: sourcetype="PubsCounts-too_small" * |fields account received, authorized, Difference |eval Difference= (authorized-received) | chart values(Difference) as Difference by account It displays well except that I would like to have a heatmap on the difference column. If I view the results, I can use the heatmap to great effect. How can I use a heatmap in this search on the dashboard? BTW: It is an inline search. |
|
The simplified XML dashboards dont have this ability - you cant do it from the editing UI that you see, nor from editing the simplified XML source. However the entire simplified XML is just a shortcut layer to the advanced XML syntax. And in the advanced xml this is relatively easy to do. Converting from the simplified XML to the advanced XML is briefly discussed on this page http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard however here are the individual steps spelled out:
converting from a simplified dashboard brings a bunch of weird cruft into the advanced world, but it'll work fine. Once its converted, getting your heatmap is simply a matter of: finding this line: and inside that module, ie right under that line, put Nick, I'm using 4.0.10 at present and showsource does not give me any XML. What other options do I have to either generate advanced XML or to get the heatmap some other way? Ken
(10 May '10, 15:36)
kmattern
I see. =) Well honestly the path of least resistance is probably to install a copy of 4.1 on your laptop briefly, copy over the simplified XML view, and use its showsource=1 to do the conversion and then copy the result back to your instance.
(10 May '10, 17:05)
nick ♦
|
