Time heatmap

Overview

This chart represents the values of a single parameter in a calendar matrix of days and hours.

What data do I need for this widget?

The option to create this chart will be disabled unless your query contains at least one column with numeric values and you group your data using a temporal option.

Creating a time heatmap

1. Go to Data Search and open the required table.

2. Perform the required operations to get the data you want to use in the chart.

3. Click the gear icon on the toolbar and select Charts → Diagrams → Time Heatmap.

4. Click and drag the column header to the Value field. This diagram requires you to specify only one field:

   Required field	Data type
   Value	float, integer, duration

5. The time heatmap is displayed.
   
   

Working with time heatmaps

Hover over a square on the map to see at the top the value and position in the color range.

Hover over a square in the color range to highlight the values of the chart corresponding to that color. Click it to maintain them highlighted when moving the cursor away and click it again to remove the highlight.

You can use the following options to visualize different aspects of your time heatmap:

• Click on realtime to use in the diagram realtime data or the temporal grouping performed in the table.
• Click on color by element of column to change the color scale based on the range of values in each column instead of the whole set of values of the diagram.
• Click on the Data operation drop-down and select an operation (none, log or arctan) to change the data normalization pattern. This might be useful when some values are too far from the general range so normalization is needed for a more cohesive representation. 
• Click on Gradient reduction drop-down and select an operation (No max min reduction, Standard deviation reduction, Percentile 5%-95%, Percentile 10%-90% or Percentile 20%-80%) to change the data marginalization pattern. This might be useful when most of the values are too close to the general range so marginalization is needed for a more extensive representation.

Click on the button at the top right of the diagram to export the content as a CSV file.

Query example

You can recreate the example shown in the picture above with the data from the following query and mapping the fields as follows:

from siem.logtrust.web.activity
  group every 5m by responseLength, method
  every 5m