Parallel Coordinates

Parallel Coordinates

Create a parallel coordinates query

Learn how to write a query to generate a parallel coordinates visualization.

Query syntax

To generate a parallel coordinates visualization, use this query syntax.

... | <stats_function> by <dimension_field1>[, <dimension_field2>,  ... <dimension_fieldN>]  [ | fields -count ]


Query components

<stats_function>
Required
Use this command to aggregate values in the field whose patterns you are tracking.
<dimension_field1>
Required
Values in this field appear on the visualization Y-axis. Indicate the field whose values you want to track through one or more dimensions in the visualization. For example, use a Food_group field to trace different nutrient counts for each group.
Additional <dimension_field> list
Optional
List additional fields whose values you want to include in the pattern you are tracking. Each field represents an additional dimension for the visualization.
Search results must include at most 15 dimension fields to render the visualization.
fields -count
Optional
Use this command to remove the count field from the search results. This might be useful if you are tracking patterns instead of metric counts.


Search result data formatting

The parallel coordinates query syntax returns results in a table with multiple columns. Columns represent each dimension in the query and an optional count or other aggregation field.

Check the Statistics tab after running a query to make sure that the results table includes the correct columns in the required order.

First Second Third
Y-axis field. Lines in the visualization originate with values in this field. (Optional) One or more additional dimensions to include in the pattern (Optional) Count or other aggregate values


Example query

Here is a parallel coordinates query tracking fat and calorie information for different food groups.

| inputlookup nutrients.csv | head 2500   | stats count by group, "fat (g)", "calories"

The query generates a table with columns for the food group, additional dimensions, and the count.

CustomViz parallel table.png

Last modified on 12 August, 2016
Parallel coordinates installation   Parallel coordinates components

This documentation applies to the following versions of Parallel Coordinates: 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters