Documentation > Splunk > User Manual > Visualization reference

User Manual

 


Welcome
Splunk Overview
Splunk Tutorial!
Index New Data
Search and Investigate
Capture Knowledge
Automate Monitoring
Analyze and Report
Search Examples and Walkthroughs

Visualization reference

Contents

Visualization reference

Splunk provides a number of options for search result visualization. Along with the straightforward "event listing" visualization, you can see your event data presented in the form of tables and charts (such as column, line, area, and pie charts). And if you're working with a search that results in a single, discrete, numerical value, you can visualize it with a variety of gauge and single value displays.

In this topic, we provide examples of Splunk's visualization options. But we'll begin by pointing out the different ways that you can access Splunk's visualization functionality.

It's important to note that your visualization options can be limited if the search you're using doesn't return data in a structure that they support. For example, you need a reporting command (such as stats, timechart, or top) to return search results in a data structure that supports both tables and chart visualizations (like column, bar, line, area, and pie charts). For more information, see "Data structure requirements for visualizations," in this manual.

For more information about building searches with reporting commands, see "Use reporting commands" in this manual.

Accessing Splunk's visualization definition features

It's easy to access Splunk's visualization definition functionality through the Splunk Web UI. You have four options; the option you choose depends on your needs at that time and the use to which you'd like to put the visualization, if any. You can:

Search app viz options.png
Keep in mind that the table and chart options may be unavailable if the search is not returning data in a structure that they support (see the note about data structures, above).
4.3 show create dashboard panel menu.png
For more information about dashboard creation and editing, see the "Create and edit simple dashboards" and "Edit dashboard panel visualizations" topics in this Manual. Note: This method of visualization design may give you more charting options than the others in this list.
4.3 show create report menu.png
For more information about building reports with the Report Builder, see "Define reports," in this manual.
4.3 advanced charting nav.png
For more information about this view, see "Use report-rich dashboards and views," in this manual.

Events

Events visualizations are essentially raw lists of events.

You can get events visualizations from any search that does not include a transform operation, such as a search that uses reporting commands like stats, chart, timechart, top, or rare. For example, if you just search for a set of terms and field values, you'll end up with a list of events:

error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

But if you add a reporting command to that search, you instead get statistical results that can be presented either as a table or a chart, but not an event list:

error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) ) | stats count by host

The following events visualization lists indexing errors over all time. It is based on this search:

index=_internal NOT( source=*searches.log ) (ERROR OR FATAL OR CRIT) AND (STMgr OR HotDBManager OR databasePartitionPolicy OR MPool OR TPool OR timeinvertedIndex OR StreamGroup OR IndexableValue )

You can find this dashboard panel in the "Index health" status dashboard; it is delivered with Splunk.

4.3 event list example.png

With event listing visualizations, you can:

Tables

You can pick table visualizations from just about any search, but the most interesting tables are generated by searches that include transform operations, such as a search that uses reporting commands like stats, chart, timechart, top, or rare.

Here's an example of a table that MyFlowerShop, a hypothetical flower company, has designed to track price differences between its products and those of its hypothetical competitor, Flowers R Us. The actual search used is:

sourcetype=access_* | stats values(product_name) as product by price, flowersrus_price | eval difference = price - flowersrus_price | table product, difference

4.3 table viz example.png

Note that in this example table, the cells in the difference column are shaded. This is because we have chosen a Data overlay of heat map for the table, which means that the high values are shaded red, while the low values are shaded blue. In this example, products that have a higher price at MyFlowerShop than they do at their competitor are shaded red, while products that are cheaper at MyFlowerShop are shaded blue.

For tables, you can:

If you are formatting tables in dashboards with the Visualization Editor you can additionally determine how drilldown works for them. You can enable drilldown by row or by cell, or disable drilldown for the table entirely. For more information about drilldown functionality, see "Understand basic table and chart drilldown actions", in this Manual.

Sparklines in tables

You can arrange to have your tables display sparkline visualizations. Sparklines can increase the usefulness and overall information density of tables in reports and dashboards; they show hidden patterns in your data that might otherwise be hard to identify in your table results.

To use sparklines, your underlying search has to use the stats or chart reporting command. You add the sparklines function of those commands to tell Splunk to add a sparkline column to this table. For details on how this works, see "Add Sparklines to your search results" in the User Manual.

The following sparkline example runs off of this search, which looks at USGS earthquake data (in this case a CSV file that presents all magnitude 2.5+ quakes recorded over a given 7-day period, worldwide):

source=eqs7day-M2.5.csv | stats sparkline(avg(Magnitude),6h) as magnitude_trend, count, avg(Magnitude) by Region | sort count

The search displays the top 10 regions according to the total count of quakes experienced per region over that period. The sparkline in the resulting table illustrates the trend in earthquake magnitude over the course of that week for each of the top earthquake regions:

Spk magTrend example.png

This example also demonstrates how you can mouse over the sparkline to get a read of the values at specific points along its length.

Charts

Splunk provides a variety of chart visualizations, such as column, line, area, scatter, and pie charts. These visualizations require transforming searches (searches that use reporting commands) whose results involve one or more series.

A series is a sequence of related data points that can be plotted on a chart. For example, each line plotted on a line chart represents an individual series. You can design transforming searches that produce a single series, or you can set them up so the results provide data for multiple series.

It may help to think of the tables that can be generated by transforming searches. Every column in the table after the first one represents a different series. A "single series" search would produce a table with only two columns, while a "multiple series" search would produce a table with three or more columns.

All of the chart visualizations can handle single-series searches, though you'll find that bar, column, line, and pie chart visualizations are usually best for such searches. In fact, pie charts can only display data from single series searches.

On the other hand, if your search produces multiple series, you'll want to go with a bar, column, line, area, or scatter chart visualization.

For a detailed discussion of the data structure requirements for the different kinds of chart visualizations, see the topic "Data structure requirements for visualizations," in this manual.

Column and bar charts

Use a column chart or bar chart to compare the frequency of values of fields in your data. In a column chart, the x-axis values are typically field values (or time, especially if your search uses the timechart reporting command) and the y-axis can be any other field value, count of values, or statistical calculation of a field value. Bar charts are exactly the same, except that the x-axis and y-axis values are reversed. (See the "Visualization data structure requirements" topic, in this manual, for more information.)

The following bar chart presents the results of this search, which uses internal Splunk metrics. It finds the total sum of CPU_seconds by processor in the last 15 minutes, and then arranges the processors with the top ten sums in descending order:

index=_internal "group=pipeline" | stats sum(cpu_seconds) as totalCPUSeconds by processor | sort 10 totalCPUSeconds desc

Charts - bar.png

Note that in this example, we've also demonstrated how you can roll over a single bar or column to get detail information about it.

When you define the properties of your bar and column charts, you can:

If you are formatting bar or column charts in dashboards with the Visualization Editor you can additionally:

Stacked column and bar charts

When your base search involves more than one data series, you can use stacked column charts and stacked bar charts to compare the frequency of field values in your data.

In an unstacked column chart, the columns for different series are placed alongside each other. This may be fine if your chart is relatively simple--total counts of sales by month for two or three items in a store over the course of a year, for example--but when the series count increases it can make for a cluttered, confusing chart.

In a column chart set to a Stack mode of Stacked, all of the series columns for a single datapoint (such as a specific month in the chart described in the preceding paragraph) are stacked to become segments of a single column (one column per month, to reference that example again). The total value of the column is the sum of the segments.

Note: You use a stacked column or bar chart to highlight the relative weight (importance) of the different types of data that make up a specific dataset.

The following chart illustrates the customer views of pages in the website of MyFlowerShop, a hypothetical web-based flower store, broken out by product category over a 7 day period:

Charts - stacked column.png

Here's the search that built that stacked chart:

sourcetype=access_* method=GET | timechart count by categoryId | fields _time BOUQUETS FLOWERS GIFTS SURPRISE TEDDY

Note the usage of the fields command; it ensures that the chart only displays counts of events with a product category ID; events without one (categorized as null by Splunk) are excluded.

The third Stack mode option, Stacked 100%, enables you to compare data distributions within a column or bar by making it fit to 100% of the length or width of the chart and then presenting its segments in terms of their proportion of the total "100%" of the column or bar. Stacked 100% can help you to better see data distributions between segments in a column or bar chart that contains a mix of very small and very large stacks when Stack mode is just set to Stacked.

Line and area charts

Line and area charts are commonly used to show data trends over time, though the x-axis can be set to any field value. If your chart includes more than one series, each series will be represented by a differently colored line or area.

This chart is based on a simple search that reports on internal Splunk metrics:

index=_internal | timechart count by sourcetype

Charts - line.png

The shaded areas in area charts can help to emphasize quantities. The following area chart is derived from this search, which also makes use of internal Splunk metrics (you can find a version of this dashboard panel in the "Search activity overview" dashobard which is delivered with Splunk):

index=_internal source=*metrics.log group=search_concurrency "system total" NOT user=* | timechart max(active_hist_searches) as "Historical Searches" max(active_realtime_searches) as "Real-time Searches"

Charts - area.png

When you define the properties of your line and area charts, you can:

If you are formatting line or area charts in dashboards with the Visualization Editor you can additionally:

Stacked line and area charts

Stacked line and area charts operate along the same principles of stacked column and row charts (see above). Stacked line and area charts can help readers when several series are involved; it makes it easier to see how each data series relates to the entire set of data as a whole.

The following chart is another example of a chart that presents information from internal Splunk metrics. The search used to create it is:

index=_internal per_sourcetype_thruput | timechart sum(kb) by series useother=f

Charts - stacked area.png

Pie chart

Use a pie chart to show the relationship of parts of your data to the entire set of data as a whole. The size of a slice in a pie graph is determined by the size of a value of part of your data as a percentage of the total of all values.

The following pie chart presents the views by referrer domain for a hypothetical online store for the previous day. Note that you can get metrics for individual pie chart wedges by mousing over them.

Charts - Pie.png

When you define the properties of pie charts you can set the chart title. If you are formatting pie charts in dashboards with the Visualization Editor you can additionally:

Scatter chart

Use a scatter chart ( or "scatter plot") to show trends in the relationships between discrete values of your data. Generally, a scatter plot shows discrete values that do not occur at regular intervals or belong to a series. This is different from a line graph, which usually plots a regular series of points.

Here's an example of a search that can be used to generate a scatter chart. It looks at USGS earthquake data (in this case a CSV file that presents all magnitude 2.5+ quakes recorded over a given 7-day period, worldwide), pulls out just the Californian quakes, plots out the quakes by magnitude and quake depth, and then color-codes them by region. As you can see the majority of quakes recorded during this period were fairly shallow--10 or fewer meters in depth, with the exception of one quake that was around 27 meters deep. None of the quakes exceeded a magnitude of 4.0.

Charts - Scatter.png

To generate the chart for this example, we've used the table command, followed by three fields. The first field is what appears in the legend (Region). The second field is the x-axis value (Magnitude), which leaves the third field (Depth) to be the y-axis value. Note that when you use table the latter two fields must be numeric in nature.

source=eqs7day-M2.5.csv Region=*California | table Region Magnitude Depth | sort Region

For more information about the data structures that scatter charts require, see the " Visualization data structure requirements" topic, in this manual.

When you define the properties of your scatter charts, you can:

If you are formatting bar or column charts in dashboards with the Visualization Editor you can additionally:

Single-value visualizations

Single value displays and gauges are designed to interpret the results of a transforming search that returns a single value whenever it is run, such as a search that returns the total count of events fitting a specific set of search criteria over a specific time range (or within a real-time window, in the case of real-time searches).

For example, this search presents the total number of Splunkd errors over the past hour:

index=_internal source="*splunkd.log" log_level="error" | stats count as errors

There are numerous ways to make searches arrive at single values, such as combining the top command with head=1.

For more information on the data structure requirements of single value visualizations, see the "Chart gallery" topic in this manual.

Note: When you design dashboard visualizations, you'll see that you can select single value visualizations even when you're working with a search that doesn't return a single value. In the case of dashboards, when a single value visualization is based on a transforming search that returns multiple values, it works with the value in the first cell of the resulting table. It doesn't matter whether the search involves a single series or multiple series. The other visualization setup options (the Search app timeline view, the Report Builder, and the Advanced Charting view) do not allow this when searches that return more than one value are involved.

Single value dashboard display

The single value display is available for dashboards only. When you base it on a search that returns a single numerical value, it displays the current result for that search. If you base the visualization on a real-time search that returns a single value, the number displayed changes as the search interprets incoming data.

4.3 single val display ex.png

You can arrange to have a single value display visualization change color depending on where the value it's displaying fits within a defined range, but to do so you'll have to include a special search command in the a underlying search and work with the XML underneath the panel just a bit. To activate this functionality, follow these steps:

1. Design a search that returns a single value and which uses the rangemap command to define the range. By default, Splunk associates the color green with word low, the color yellow with elevated, and red with severe. The example single value display panel above is based on this search:

index=_internal source="*splunkd.log" log_level="error" | stats count as errors | rangemap field=errors low=1-3 elevated=4-15 default=severe

2. Create the panel for the dashboard, selecting Single value as the visualization type. For more information about creating dashboards and panels, see "Create and edit simple dashboards," in this manual.

3. Set Edit: to On to put the dashboard in editing mode. Click Edit XML to see the view XML for the dashboard in the XML editor.

4. Locate the module XML for the single value display panel that you want to edit. You can locate it by looking for the <searchstring> and <label> lines that have the search and title of the panel in question. Once you find it, add this below the <title> line:

<option name="classField">range</option>

5. Click save to return to the normal dashboard view. Your single value panel should now display either green, yellow, or red, depending on the number presented and the range you've defined for it.

For more information about working with the XML code behind single value display dashboard panels, see "Add a single value" in the Developer Manual.

Single value dashboard display formatting options

When you define a single value dashboard display with the Visualization Editor, you can:

4.3 single val with before-after text-1.png

Gauges

Splunk provides three types of gauge visualizations: radial, filler, and marker.

Gauge visualizations map a single numerical value against a range of colors that may have particular business meaning or logic. As the value changes over time, the gauge marker changes position within this range. Gauges are designed to provide an especially dynamic visualization for real-time searches, where the value returned fluctuates as events are returned, causing the gauge marker to visibly bounce back and forth within the range as you watch it.

The various gauge examples below have the same base search. It is:

index=_internal source="*splunkd.log" log_level="error" | stats count as errors

Radial gauge

The radial gauge type looks essentially like a speedometer or pressure valve gauge. It has an arced range scale and a rotating needle. The current value of the needle is displayed at the bottom of the gauge (in the case of the example below, the value is 915). If the value falls below or above the specified minimum or maximum range, the needle "flutters" at the upper (or lower) boundary, as if it is straining to move past the limits of the range.

Here's an example of the "shiny" version of the radial gauge:

Radial gauge example-1.png

And here's what the "minimal" version of the radial gauge looks like:

4.3 radial gauge minimal-1.png

Filler gauge

The filler gauge is similar in appearance to a thermometer, with a liquid-like filler indicator that changes color as it rises and passes gauge range boundaries. So imagine you have set up three ranges. The lower colored green , yellow, and red, the liquid will appear to be green when it is near the bottom, yellow when it reaches the midpoint boundary, and red when it gets to the top. The current value of the gauge fill is displayed at the left side of the filler indicator.

Filler gauge - unfull example.png

The filler gauge is oriented vertically by default but can be oriented horizontally through custom charting configuration.

Marker gauge

The marker gauge is a linear version of the filler gauge. It is already "filled"; a gauge marker rests at the value returned by the search. If the gauge is displaying the results of a real-time search, the marker can appear to slide back and forth across the range as the returned value fluctuates over time. If the returned value falls outside of the upper or lower ranges of the marker gauge, the marker appears to vibrate at the upper (or lower boundary), as if it is straining to move past the limits of the range.

Marker gauge-1.png

The marker gauge is oriented vertically by default but can be oriented horizontally through custom charting configuration.

Marker gauges have display issues with numbers exceeding 3 digits in length. To manage this, you can set up a search that divides a large number by a factor that reduces it to a smaller number. For example, if the value returned is typically in the tens of thousands, set your search up so the result is divided by 1000. Then a result of 19,100 becomes 19.1.

You can also deal with large numbers by setting the chart configuration options so the range is expressed as a percentage. For more about that, see the next subsection.

Formatting gauge visualizations via Splunk Web

All of Splunk's UI-based visualization definition options enable you to define how your gauges appear. You have the most formatting options when you use the dashboard Visualization Editor to set up a gauge in a dashboard panel. The Visualization Editor enables you to:

Note: When you are formatting gauge visualizations through the Visualization Editor, you can have it define color ranges automatically (by using values defined in the search string in conjunction with the gauge command--see below) or manually (by using settings defined in the Visualization Editor).

For more information about using the Visualization Editor to format dashboard panel visualizations, see the topic "Edit dashboard panel visualizations," in this Manual.

Splunk's other visualization definition options--the Report Builder, the Advanced Charting view, and the results area of the Search App only provide the ability to give titles to gauge visualizations. By default they'll create a gauge with three ranges: 1-30, 31-70, and 71-100. These ranges are colored green, yellow, and red, respectively. To set up different gauge ranges with these visualization definition options, you'll need to update the underlying search with the gauge search command, as defined in the following subtopic.

Setting gauge ranges with the gauge command

When you're using a visualization definition option other than the dashboard Visualization Editor, you'll need to use the gauge command to set custom ranges for a gauge visualization.

The gauge command only enables you to set the gauge ranges; Splunk assigns colors to each range automatically. With gauge, you indicate the field whose value will be tracked by the gauge. Then you add "range values" to the search string that indicate the beginning and end of the range as well as the relative sizes of the color bands within it.

For example, to set up a gauge that tracks a hitcount field value with the ranges 100-119, 120-139, 140-159, 160-179, and 180-200 you would add this to your search string:

...| gauge hitcount 100 120 140 160 180 200

Splunk chooses default colors for these ranges (the first three are always green, yellow, and red).

Note: If you do not include the gauge command in your search (or do use it but fail to include range values along with it), Splunk inserts default range values of 0 30 70 100 when it generates the gauge visualization.

Additional visualization options

Splunk offers visualization options that are unavailable via Splunk Web tools like the Report Builder and the Visualization Editor for dashboard panels. You can set these additional visualization options up in dashboard panels using Splunk's view XML and the custom charting configuration controls.

These additional visualization options include:

You can use bubble charts to show trends and the relative importance of discrete values in your data. The size of a bubble indicates a value's relative importance. It represents a third dimension on top of the x-axis and y-axis values that plot the bubble's position on the chart. This dimension determines the bubble's size relative to the others in the chart.

Range marker charts and value marker charts are designed to work as overlays on top of bar, column, line, or area charts.

For more information about these chart types, the data structures required to support them, and their view XML properties, see the Custom charting configuration reference chapter in the Developer Manual.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3/User/ChartGallery"

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!