Punchcard

Punchcard

Create a punchcard search

To create a punchcard, you must use a search that returns data in the correct format.

Search syntax

Use this syntax to generate a punchcard.

... | <stats_function>[(metric_field)] [<stats_function>(color_field)] by <first_dimension> <second_dimension>


Search components

<stats_function>

  • Required
  • Determines circle size.
  • Use this function to aggregate the metric you are tracking.


color_field

  • Optional
  • Determines circle color.
  • Use a stats function to aggregate values in this field.
  • For sequential color mode, values in this field must be numerical.


<first_dimension>

  • Required
  • Represents the first dimension for plotting results.
  • For example, you can use a time field such as date_hour.


<second_dimension>

  • Required
  • Represents the second dimension for plotting results, usually more granular than the first dimension.
  • For example, you can use a time field such as date_wday.

Search results data format

After running the search, check the Statistics tab. The results table includes columns representing the metric, color field, and two time dimensions.

Make sure that the results table has columns for required fields in this order.

First Second Third Fourth
first_dimension second_dimension count or other aggregated value color_field (optional)


Search example

Here is a search that analyzes bicycle rental popularity by hours and days.

inputlookup bikeshare.csv | stats count by date_hour date_wday


The search generates the following results table.

Punchcard results table.png

Last modified on 09 September, 2020
Punchcard installation   Punchcard components

This documentation applies to the following versions of Punchcard: 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters