Data structure requirements for visualizations
Visualizations require search results in specific formats or data structures. Write queries to generate results in the correct format for the visualization that you are building.
This topic provides an overview of data structures for visualizations. To learn about requirements for a specific visualization and how to generate results in the correct format, see one of the following topics.
- Events list
- Using events lists
- Table visualizations
- Generate a table
- Single value
- Generate a single value
- Using gauges
- Mapping Data
For an overview of visualization options, see the Visualization Reference in this manual.
Data and formatting requirements
Depending on the visualization that you are creating, you can use specific search commands to generate results in the correct format. For example, many visualizations require a search using transforming commands, such as
geostats to render.
Charts visualize one or more data series, or related data points. Depending on the chart type or complexity, the number and ordering of data series can vary.
Single value and gauge visualizations represent a single numerical value.
Maps combine a query and other data components, including data with coordinates or place information, lookup definitions, and geographical markup files.
Using the statistics table
When creating a visualization, you can check the Statistics table after running a search to make sure that result fields are generated correctly. The number and order of Statistics table columns show you the data structure that a search generated.
Review specific visualization topics to check data format requirements and query recommendations.
To learn more about search commands that can generate visualizations, see the following topics.
Using events lists
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 7.0.0