Developing Dashboards, Views, and Apps for Splunk Web

 


Advanced configuration - Layout and data table properties

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Advanced configuration - Layout and data table properties

Most basic charting requirements can be dealt with using the properties and elements discussed in the preceding chart reference topics. But advanced charting configurations (such as the creation of multiple charts that share axes) it's necessary to control the layout of elements and the routing of data.


Layout

Usage: charting.layout.*

The layout element controls the layout of all visual chart elements. It consists of lists for the five main visual element types: charts, legends, axis labels, axis titles, and grid lines. Each list contains one or more references to predefined elements.

By default, these lists are automatically configured depending on the value of the chart property.

Example

For example, if the chart property is set to a cartesian (dual axis) chart such as line, the default layout list configuration is:

<option name="charting.layout.charts">[@chart]</option>
<option name="charting.layout.legends">[@legend]</option>
<option name="charting.layout.axisLabels">[@axisLabelsX,@axisLabelsY]</option>
<option name="charting.layout.axisTitles">[@axisTitleX,@axisTitleY]</option>
<option name="charting.layout.gridLines">[@gridLinesX,@gridLinesY]</option>

In most cases you only need to change the default layout configuration if you are designing advanced chart layouts that use multiple charts and multiple, shared axes. For example, say you want to define two charts where one overlays the other so that they share the same x-axis, but have different y-axes (one on the left side of the chart, and another on the right side of the chart). You would start by defining two custom chart types, chart1 and chart2. We can configure the charts list to render those custom charts instead of the default chart:

<option name="charting.layout.charts">[@chart1,@chart2]</option>

More information about configuring multiple charts that share axes is coming soon.

Also used by

The layout element is not used by any other element.

Layout properties

The layout element controls the page layout for other visual chart elements.
Property name Value type Definition Default Supported by JSChart?
charts array<chart> A list of one or more chart element references. Must be comma-delimited without spaces and set within brackets. Varies by chart type. Depends on the chart properties involved.
legends array<legends> A list of one or more legends element references. Must be comma-delimited without spaces and set within brackets. Varies by legend type. Depends on the legends properties involved.
axisLabels array<axisLabels> A list of one or more axisLabels element references (one for single-axis charts, two for cartesian charts, more for chart layouts with shared axes). Must be comma-delimited without spaces and set within brackets. Varies by axis label type. Depends on the axisLabels properties involved.
axisTitles array<axisTitle> A list of one or more axisTitle element references (one for single-axis charts, two for cartesian charts, more for chart layouts with shared axes) Must be comma-delimited without spaces and set within brackets. Varies by axis title reference. Depends on the axisTitle properties involved.
gridLines array<gridLines> A list of one or more gridLines element references. Must be comma-delimited without spaces and set within brackets. Varies by grid line reference. Depends on the gridLines properties involved.
margin margin A comma-delimited list of four numeric values corresponding to left, right, top, and bottom, respectively) enclosed in parenthesis, without spaces. It is measured in pixels. Margins are almost always positive values, but negative values can be used as well to "trim" away at the bounding box of an object, which can be useful to get labels or other text objects to appear to be more tightly packed together. (0,10,10,0) No
splitSeries boolean This is a special switch that splits a multi-series chart into separate charts that are stacked from top to bottom, one for each series. It is most applicable to area, bar, column, and line charts (it may produce confusing results with other chart types). false Yes
splitSeriesMargin margin A comma-delimited list of four numeric values corresponding to left, right, top, and bottom, respectively) enclosed in parenthesis, without spaces. This is the margin that appears around each split-series chart when splitSeries = true (see above). By default it places a five-pixel margin at the top and bottom of each chart in order to space them apart in their stack. (0,0,5,5) No

Data

Usage: charting.data.*

When Splunk generates a chart it requires that the data that the chart is based upon be contained in a tabular format. Data tables organize reporting data into rows and columns that provide the x-axis values for single-axis chart types (such as range marker and value marker charts) and the x- and y-axis values for dual-axis chart types (such as bar, column, line, and area charts).

The data element is used by all chart types.

Values

The data element has three possible values:

Example

Sets up a chart that counts only the first 500 results and previews them.

<option name="charting.data">results</option>
<option name="charting.data.count">500</option>
<option name="charting.data.preview">true</option>

Also used by

  • charting.chart.data.*

See the chart subtopic for more information.

Results data table properties

The results data table collects the results data from a search job.
Property name Value type Definition Default Supported by JSChart?
jobID string The search job ID. Not assigned Yes
offset number The offset of the first retrieved result. 0 Yes
count number The number of results to retrieve. Set 0 to get all results. 1000 Yes
search string The post-processing search to apply to the results, if necessary. Not assigned Yes
preview boolean Whether or not results are previewed. false Yes
fieldListMode string The order in which to apply the fieldShowList and fieldHideList filters. Valid values are show_hide and hide_show. hide_show Yes
fieldShowList array<string> The list of fields to explicitly show in the results. Not assigned Yes
fieldHideList array<string> The list of fields to explicitly hide from the results Not assigned Yes

Timeline data table properties

The timeline data table collects the timeline data from a search job.

Property name Value type Definition Default Supported by JSChart?
jobID string The search job ID. Not assigned Yes

View data table properties

A view data table collects a "view" (a subset, in other words) of data from another data table.
Property name Value type Definition Default Supported by JSChart?
table datatable The table from which to create a view Not assigned Yes
rows array<slice> The list of slices indicating which rows of the table to include in the view. All rows are included by default. Yes
columns array<slice> The list of slices indicating which columns from the table to include in the view All columns are included by default. Yes

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!