Calendar Heat Map

Calendar Heat Map

Create a calendar heat map query

To generate a calendar heat map, write a query that returns events in the correct data format.

Query syntax

To generate a calendar heat map, use the following query syntax. Use the time range picker to adjust the time range that the visualization shows.

... | timechart span= [1m | 1h | 1d] <stats_function> [by <category_field>] | [...]

Query components

A calendar heat map query includes the following components.

Use the timechart command to generate a _time field.
span [1m | 1d | 1h]
Specify a span of one minute, one hour, or one day.
Depending on the time span you specify, select a corresponding time range for best results. See the following table.
For this timechart span Use this time range
1m (one minute) Less than twelve hours of data
1h (one hour) Less than two weeks of data
1d (one day) Less than one year

If the search returns more data than can be rendered in the visualization, a warning displays.

Use a stats function to aggregate values.
Specify a category field with values to aggregate.

Search result data formatting

The calendar heat map query syntax returns results in a table with multiple columns. Columns represent the _time field and one or more resources that you are tracking.

Check the Statistics tab after running a query to make sure that the results table includes the following columns.

  • _time
  • stats result field, such as a count. The stats result fields can be grouped by category if you are using a category field.

Example queries

This query looks for video game purchasing patterns across all product types.

...| timechart span=1h count

The query generates the following Statistics table.

Screen Shot 2016-05-06 at 2.08.27 PM.png

Example including a category field

This query includes a category field to count results for each product type.

... | timechart span=1h count by categoryId 

This query generates the following Statistics table.

Customviz table for cal heat map.png

Last modified on 12 August, 2016
Install a calendar heat map   Calendar heat map components

This documentation applies to the following versions of Calendar Heat Map: 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1

Was this topic useful?

You must be logged into in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters