Create a pivot chart
In the previous topic you used Pivot visualization editor to build a table. In this topic, you will use the same dataset to create chart visualizations.
Define a new Pivot
- From the Splunk bar, select Settings > Data models.
- Select the Buttercup Games data model.
- In the Datasets editor page, click Pivot. In the Select a Dataset page, select the Successful Purchases child dataset.
The New Pivot editor for Successful Purchases opens.
Add Pivot elements
For the pivot chart, let's report on the count of successful purchases by category.
To do this, you will add a Split Row using the
- Under Split Rows, click + and select
categoryIdfrom the list.
- For Label type
Categoryand click Add to table.
This returns the following Pivot table.
Change the visualization type
- Click the Column Chart icon from the visualization bar.
The New Pivot editor for the Column chart displays.
- Column charts use the first split row element in pivot table definitions to provide their X-axis values. In this case, that Split Row is Category.
- Column charts use the first column value element in pivot table definitions to provide their Y-axis values. Here, that Column Value is Count of Successful Purchases.
- Click the Pie Chart icon from the visualization bar:
The New Pivot editor for the Pie chart displays.
- Pie charts use the values from the first Split Row element (Category) to determine the number and colors of their slices.
- Pie charts use the first Column Value element (Count of Successful Purchases) to determine the relative sizes of their slices.
Mouseover a slice of the pie chart to view the metrics: Category, Count of Successful Purchases, and percentage of the total Count of Successful Purchases.
This data can also be visualized as a pie chart.
In this chapter you created three pivots and saved two of them as reports. This last pivot chart, you will save as a dashboard panel. Continue to the next chapter to read about dashboards.
Create a pivot table
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8