Create a calendar heat map query

To generate a calendar heat map, write a query that returns events in the correct data format.

Query syntax

To generate a calendar heat map, use the following query syntax. Use the time range picker to adjust the time range that the visualization shows.

... | timechart span= [1m | 1h | 1d] <stats_function> [by <category_field>] | [...]

Query components

A calendar heat map query includes the following components.

timechart

Required

Use the timechart command to generate a _time field.

span [1m | 1d | 1h]

Required

Specify a span of one minute, one hour, or one day.

Depending on the time span you specify, select a corresponding time range for best results. See the following table.

For this timechart span	Use this time range
1m (one minute)	Less than twelve hours of data
1h (one hour)	Less than two weeks of data
1d (one day)	Less than one year

If the search returns more data than can be rendered in the visualization, a warning displays.

<stats_function>

Required

Use a stats function to aggregate values.

<category_field>

Optional

Specify a category field with values to aggregate.

Search result data formatting

The calendar heat map query syntax returns results in a table with multiple columns. Columns represent the _time field and one or more resources that you are tracking.

Check the Statistics tab after running a query to make sure that the results table includes the following columns.

• _time
• stats result field, such as a count. The stats result fields can be grouped by category if you are using a category field.

Example queries

This query looks for video game purchasing patterns across all product types.

...| timechart span=1h count

The query generates the following Statistics table.

Example including a category field

This query includes a category field to count results for each product type.

... | timechart span=1h count by categoryId 

This query generates the following Statistics table.