Smart AnSwerS #43

Hey there community and welcome to the 43rd installment of Smart AnSwerS.

It’s been a pretty long week, but what better way to take a break for a change of pace with a party! I just got a reminder email that Splunk HQ is celebrating Diwali this afternoon, a Hindu festival of lights celebrated in the Fall every year. The courtyard will apparently be full of food, mehndi, and a talent show, oh my! Time to give my eyes a break from this monitor for a bit.

Check out this week’s featured Splunk Answers posts:

How to get a table cell color to change depending on the field value?

fredkaiser did some hunting around Answers, but couldn’t quite find how to get table cells to change color based on certain field values. The first user to come along and put him on the right path was tom_frotscher who suggested looking at the “Table Cell Highlighting” example in the Splunk 6.x Dashboard Examples app, a great resource to use as reference for your visualization needs. Flynt came in after to give an incredibly comprehensive answer for the community to get the full picture on how this is done. He presented sample XML, JavaScript, and CSS code, explained how each one works, where to place the files, and how to get the changes to take effect.

How can I search and graph the number of people with a specific status or multiple statuses for a certain period of time?

JWBailey had data from a system that tracks the status of about 100 users, and needed to write a search to graph the number of people with a specific status or multiple statuses for a window of time. Prepare yourself for another lesson in Search Processing Language as sideview breaks down various key search commands as stats, chart, and timechart to tackle this question, the obvious and not so obvious approaches, issues you may run in to, and examples of different ways to run statistics to produce different types of results. This is one that everyone should save in the books for learning material and just an overall great read.

How can I create a Heat Map?

adellaroccasys had a table of latitudes and longitudes of different cities and needed to create a heat map based on values from a field in this same table. frobinson points out that as of Splunk 6.3, Choropleth maps were introduced with built-in mapping tools to visualize data across US states, as well as the option to upload a custom KMZ file and set up a lookup to translate the latitude and longitude values for custom defined regions. She links to the documentation on this and a blog on working with the KMZ files and lookups. aljohnson jumped in to add that the author of the blog developed an app called Shapester for creating custom polygons. Teamwork makes dreams work :)

Thanks for reading!

Missed out on the first forty-two Smart AnSwerS blog posts? Check ‘em out here!

Patrick Pablo

Posted by