Documentation > Splunk > User Manual > Edit dashboard panel visualizations

User Manual

 


Welcome
Splunk Overview
Splunk Tutorial!
Index New Data
Search and Investigate
Capture Knowledge
Automate Monitoring
Analyze and Report
Search Examples and Walkthroughs

Edit dashboard panel visualizations

Contents

Edit dashboard panel visualizations

The Visualization Editor provides many features to help create and modify visualizations in a panel. The visualization you choose to represent your data, of course, depends on your search query.

The Visualization Editor is only available for dashboards that use the simplified XML syntax (such as panels that have been created by the Dashboard Editor. Dashboards that have been built with advanced XML syntax can only be edited using an XML editor.

Caution: The Visualization Editor does not check if the visualization you select is appropriate for your search. If you select an inappropriate visualization, you can misrepresent the data returned. For example, if you have a search that returns data in a table, the Visualization Editor allows you to select Single Value to represent the results.

Note: The topics in this section assume familiarity with Splunk visualizations, as described in the "Visualization Reference" in this manual.

About the Visualization Editor

You can only edit panels in dashboards for which you have "write" permissions. If you have read-only access to a dashboard, you cannot change the appearance of any panels in that dashboard. By default you have write permissions for any dashboard that you create using the Dashboard Editor. However, an admin user can change those permissions.

The Visualization Editor is only available for dashboards that have been constructed with the simplified XML syntax. This includes dashboards that were created Using the Splunk Dashboard Editor. For more information on creating dashboards with the Dashboard Editor, see "Create and edit simple dashboards," in this manual.

To open the Visualization Editor for a panel in a dashboard:

1. Select Edit: On to enable editing for the dashboard.

2. Select Edit > Edit Visualization for the panel you want to edit.

Features available from the Visualization Editor

Each visualization contains a set of features that you can modify to change the appearance of the visualization. Different charts share many of the same features while other charts can contain a different set of features. This section provides a brief description of the features that you are available for editing.

For details on these features, refer to the "Visualization Reference" in this manual.

General

The General category includes a title for the visualization and other features specific to that visualization. These include:

VizGeneral.png

X Axis and Y Axis

Many charts have both an X Axis and Y Axis. Some charts, such as Pie, have only a Y Axis.

In the Visualization Editor, you can specify a title for each of these axes. Upi can also specify the following:

VizAxis.png

Legend

Charts typically color code returned results, using a legend to identify the data represented by each color. In the Visualization Editor you can specify the following for Legend:

VizLegend.png

Single Value and Gauges

For data returned as a single value, Splunk provides a Single Value visualization and various styles of gauges (Radial, Filler, and Marker). You can specify the following features for these visualizations:

VizGaugeColor.png

Data series and visualizations

When creating visualizations for charts, it is useful to think of the returned data in terms of series, a sequence of related data points that can be plotted on a chart. The visualization you choose depends on the type of series.

Series Description
Single series Produces a table with only two columns.
Multiple series Produces a table with three or more columns.
Single value Returns a single value. (Technically, this is not an example of a series.)

Note: "Data structure requirements for visualizations" in this manual provides details on how to select the appropriate visualization for your data and includes discussions on data series.

The following sections describes the charts that best represent data for each of these series. They also provide some examples of how to use the Visualization Editor to create and modify the visualizations.

Visualizations for single series

A single series search is a transforming search that produces a table with only two columns. All chart visualizations can represent a single series search effectively. However, the following charts are usually best:

The following examples use searches from the Flower Shop example, available from the Splunk Tutorial.

Note: You can follow these examples using searches that return similar results.

Column and Pie chart examples

1. Using the Dashboard Editor, create a dashboard with two panels that each specify the following inline search. Specify a time range from -7d to now.The dashboard displays the data in a table.

Views by product category, past week

sourcetype=access_* method=GET | timechart count by categoryId | fields _time BOUQUETS FLOWERS

SingleSeries1.png

2. Open the Visualization Editor for the first panel. Select Column from the list of visualizations.

3. Modify the panel title to say:

"Views by product category, past week (Stacked)"

4. For Stack mode, select Stacked. Leave Drilldown enabled.

5. Under General, specify the following:

Note: For Y Axis you could specify the units and minimum value, but leave these blank for this visualization. If your data has unusually large peaks, you can specify Log for the unit scale. This minimizes the emphasis on the peaks.

6. Click Save and view the Column visualization.

Turn editing mode off to view the panel. Mouse over the columns to view the tips that appear.

7. Return to editing mode and open the Visualization Editor for the second panel. Select Pie from the list of visualizations.

8. Modify the panel title to say:

"Views by product category, past week (Pie Chart)"

9. For Legend, specify the position at the bottom. Save your edits and turn editing mode off.

SingleSeries2.png

Tip: Modify the selections for both of these charts to see how you can change visualizations for a panel.

Example using the wrong visualization

The Visualization Editor does not enforce the correct visualization for a search. For example, for the search in the previous example for Column and Pie Chart, you could have selected Single Value for the visualization even though this cannot represent the returned data correctly. This example illustrates what happens if you select the wrong visualization.

1. In the dashboard from the previous example, add another panel with the same search and place it to the right of the other two panels.

2. For the third panel, select Single Value.

Note: The Panel title field indicates "Error." This is because Single Value does not apply to tabular data.

3. Click Save. Turn off editing mode and view your panels.

The Single Value visualization picks one value to display. Here the error is obvious, but in other examples that incorrectly specify visualizations, it may be easy to overlook errors in the display.

Wrong.png

4. Return to editing mode and delete this panel from your dashboard.

Visualizations for multiple series

A multiple series search is a transforming search that produces a table with three or more columns. The following charts are best for a multiple series search:

The following examples use the same search in the example for single series, but modifies it to return a table with five columns.

Area and Scatter chart examples

1. In the dashboard you created for single series search, add two additional panels that use the following search. Specify a time range of -7d to now</code>. Place the panels side by side in a row beneath the other panels.

Views by product category, past week

sourcetype=access_* method=GET | timechart count by categoryId | fields _time BOUQUETS FLOWERS GIFTS SURPRISE TEDDY


2. For the first panel, select Area from the list of visualizations. Modify the panel title to say:

"Views by product category, past week (Area)"

3. Make the following specifications in the Visualization Editor, then select Save:

AreaChart.png

4. For the second panel, select Scatter.

5. Modify the panel to say:

"Views by product category, past week (Scatter Chart)"

6. Select Save.

7. Click Save. Turn off editing mode and view your panels.

Mouse over areas in each panel to see how screen tips provide details for various areas. Click on sections to drilldown to the underlying data.

VizDash.png

Single value visualizations

For searches that return single values, Splunk provides the following visualizations that you can specify with the Visualization Editor:

The following example shows how to represent the value returned from a search using each of these visualizations. It uses the following search, which returns the number of log entries in a Splunk log file.

Splunk server log events

index=_internal source="*splunkd.log" ( log_level=ERROR OR log_level=WARN* OR log_level=FATAL OR log_level=CRITICAL) | stats count as log_events


Note: You must be logged in as an admin user (or a user with admin privileges) to return results from this search.


Single Value, Radial Gauge, Filler Gauge, and Marker Gauge examples

1. Log in as an admin user. In the Dashboard Editor, create a new dashboard named "Displaying single values."

2. Add four panels that use the "log events" search listed above. Name each panel "Splunk sever log events." Specify a range form -1d to now. Place the panels in two rows, each with two panels.

LogEvents1.png

3. In the first panel, open the Visualization Editor and make the following edits:

SingleValue.png

Note: The Single Value visualization can display colors, based on the value returned from the search. To display colors, modify the search and edit the underlying XML, as explained in "Single value dashboard display" in this manual.

4. Modify the other panels similarly, selecting the following visualizations. Do not specify labels for these.

5. For the Radial Gauge, click Color ranges and make the following edits, then click Save:

Note: Modify the range according to the data returned by your search to give a meaningful visualization.

ColorGauge.png

6. Turn off editing mode and view the panels.

Gauges.png

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3.2/User/EditDashboardPanelVisualizations"

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!