Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Bubble chart

Use a bubble chart to visualize multiple series data in three dimensions. Bubble position represents two dimensions of the data series. Bubble size represents the third dimension.

Data formatting

To create a bubble chart, start with a search that generates multiple data series. Use this syntax to generate the series.

... | <stats_command> <y-axis_field> <x-axis_field> <bubble_size_field>

A single group-by field in the query generates a visualization with all bubbles in the same color. To get series colors with the stats command, use two group-by fields. This generates a bubble for each unique combination of those two fields. The value of the second field determines the series color.

Configuration options

Bubble chart configurations include the following options. Use the Format menu to adjust these settings.

  • Minimum and maximum bubble marker size
  • Axis titles
  • X-axis label rotation and truncation
  • Axis scale, interval, minimum and maximum values

Create a bubble chart

Prerequisites
Review the following details about building column and bar charts.

Steps

  1. Write a search that generates three data series.
  2. Run the search.
  3. Select the Statistics tab below the search bar. The statistics table here should have four columns.
  4. Select the Visualization tab and use the Visualization Picker to select the bubble chart visualization.
  5. (Optional) Use the Format menu to configure the visualization.

Example

This search aggregates earthquake events by location. It generates data series representing the magnitude, depth, and count for each earthquake location.

source="earthquake.csv" | stats count by place, mag, depth

The search generates a bubble chart where the x-axis and y-axis plot magnitude and depth. The bubble size indicates the relative count value for a particular location.


6.4 bubble chart example.png

PREVIOUS
Scatter chart
  NEXT
Chart display issues

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters