Chart gallery

Chart gallery

You can use Splunk to generate many types of reports. Run reports on your data by:

• clicking on Report on results >> after you search.
• selecting a field from the fields menu to report on.
• using a reporting command from Splunk's search language.

Check out the tutorial to learn how to create reports.

Column (or bar) chart

Use a column chart to compare the frequency of values of fields in your data. The x-axis values are typically field values (or time) and the y-axis can be any other field value, count of values, or statistical calculation of a field value.

Example: This report shows the total kb (Kb indexed) into Splunk over time (the past 24hrs.).

Stacked column (or bar) chart

You can also use a stacked column chart to compare the frequency of values of fields in your data. A stacked column chart is the same as a column chart, except all of the columns are segments of a single column. The value of the total column is the sum of the segments.

Note: You can use a stacked column chart to highlight the relative weight (importance) of data within a set of your data.

Example:

This report shows the number of orders placed over time for each of the products offered by an online store.

Line chart

Use a line chart to show trends in your data over time or another field. You can display more than one series in a line chart.

Example: This report shows which machines were the most requested (by destination IP address) over time. The series is split by the dst_ip field to make it easy to compare them.

Area chart

Use an area graph to show trends in your data over time or compared to another field value. The shaded areas under the data points help emphasize quantities.

Example:

This report shows the top occurances of the buddy field.

Stacked area chart

Use a stacked area chart to show multiple series the trends in your data the way an area chart can. You can show how a series of data relates to the whole set of data.

Example:

This report shows CPU utilization, broken out by individual processes, on all machines that report process statistics.

Scatter plot

Use a scatter plot to show trends in the relationships between discrete values of your data. Generally, a scatter plot shows discrete values that do not occur at regular intervals or belong to a series. This is different from a line graph, which usually plots a regular series of points.

Example:

This report shows machine and service access over time. The scatter plot counts the number of distinct accesses by external machines.

Pie graph

Use a pie graph to show the relationship of parts of your data to the whole set of data. The size of a slice in a pie graph is determined by the size of a value of part of your data as a percentage of the total of all values.

Example:

This example shows the top number of occurrences of a user in the last 24 hours.

Doughnut graph

You can also use a doughnut graph to show the relationship of parts of your data to the whole set of data. Doughnut graphs are functionally identical to pie graphs. The size of a slice in a doughnut graph is determined by the size of a value of part of your data as a percentage of the total of all values.

Example:

This example shows the top number of occurrences of a user in the last 24 hours.

Bubble graph

Use a bubble graph to show trends and the relative importance of discrete values in your data.

Note: The size of a bubble indicates a value's relative importance.

Example:

This report shows the distinct count of events seen over time for the fields: Foreign, Local, and Path.

Heat map

Use a heat map to show the relative importance of field values or statistical calculations done on your data. A heat map shows the importance of a value relative to other comparable values using gradients of color.

Example:

This report shows the top values of the field buddy. The x-axis contains the discrete values of the field, and the y-axis is the count of how many times those values occurred.

• Was this topic useful?
• Post a comment