Custom visualizations

The Splunk Machine Learning Toolkit includes several reusable custom visualizations that you can use in your own dashboards. Each visualization expects data in a certain format with certain fields, indicated by the search fragment in the descriptions below.

To apply a custom visualization to your data:

1. Run a search from the Search page in the Splunk Machine Learning Toolkit or the default Search & Reporting app on the Splunk platform.

2. Click the Visualization tab, then click the menu at the top left to display available visualizations.

3. Select a visualization.

You can use these custom visualizations on any Splunk platform instance on which the Splunk Machine Learning Toolkit is installed.

Outliers Chart (OutliersViz)

Shows the acceptable range for a value and highlights the points that are outside this range.

For an example, see the Outliers chart in the Detect Numeric Outliers assistant.

search_fragment = | table _time, outlier_variable, lowerBound, upperBound

Example: ... | table _time, quantity, lowerBound, upperBound, isOutlier ...

Forecast Chart (ForecastViz)

Shows the forecast value for time series data. For an example, see the Forecast chart in the Forecast Time Series assistant.

search_fragment = | timechart count [by comparison_category] | `modvizpredict(<field>, <algorithm>, <futuretimespan>, <holdback>, <confidenceInterval>)`

Example: ... | `modvizpredict("bits_transferred", "LLP5", "224", "112", "95")` ...

Scatter Line Chart (ScatterLineViz)

Shows relationships between discrete values in two dimensions, as well as an additional identity (x=y) line. For an example, see the Actual vs. Predicted Scatter Plot chart in the Predict Numeric Fields assistant.

search_fragment = | table <xAxis> <yAxis>

Example: ... | table "median_house_value" "predicted(median_house_value)" ...

Histogram Chart (HistogramViz)

Shows continuous data bucketed by the bucket/bin command. For an example, see the Residuals Histogram chart in the Predict Numeric Fields assistant.

search_fragment = | bin <field> bins=<number>

Example: ... | bin residual bins=100 ...

Downsampled Line Chart (LinesViz)

Shows values and trends over time, using downsampling to show large numbers of points. For examples, see the Actual vs. Predicted Overlay and Residuals charts in the Predict Numeric Fields assistant.

search_fragment = | table <xAxis> <yAxis1> <yAxis2> ...

Example: ... | table _time, "median_house_value", "predicted(median_house_value)" ...

Scatterplot Matrix

Shows relationships between discrete values in multiple dimensions. For an example, see the chart in the Cluster Numeric Events assistant.

search_fragment = | table <name_category>, <dimension_1>, <dimension_2>, <dimension_3> ...

Example: ... | table cluster, "avg_rooms_per_dwelling", "business_acres", "median_house_value" ...