Splunk® Metrics Workspace (Legacy)

Using the Splunk Metrics Workspace

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of SMW. Click here for the latest version.
Acrobat logo Download topic as PDF

Charts in the Splunk Metrics Workspace

Every data source that you select in the Data panel appears as a separate chart in the Metrics Workspace. Each chart contains a time series based on at least one aggregation. Hover over any point on the series to see the corresponding values in the chart legend to the right of the chart.

The following chart shows aggregate maximum system CPU values for collectd metrics.

This screen image shows a time series chart of aggregate maximum cpu.system values for collectd metrics.

To learn how to view multiple time series on a chart, select additional aggregations, or apply analytic operations, see Analytics in the Splunk Metrics Workspace.

To view charts in the Metrics Workspace, you need specific permissions and capabilities. See Hardware and software requirements for the Splunk Metrics Workspace.

View charts in the workspace

View a chart in the workspace to see your data represented as a time series.

  1. In the Data panel, search or browse for the data source you want to view in a chart.
    Option What to do
    Search for a data source In the search box, type part or all of the data source name. The list of available data sources for each data type filters to match your criteria.
    Browse available data sources Click the tab for the type of data you want to visualize in the workspace. Then browse through the tree of available data sources.
  2. Select the data source you want to view as a time series.

The data source appears as a chart in the main panel of the Metrics Workspace.

This screen image shows an overall view of the Metrics Workspace. In the Main panel, there is a time series chart named aws.ec2.CPUUTILIZATION.

Chart actions

Click the This screen image shows the More icon. icon in the top-right corner of a chart to view a list of chart actions.

Action Description
Open in Search Show the SPL that drives the chart in the Search & Reporting App.
Search Related Events View a list of related log events.
Save as Report Save the chart as a report. Enter report details and click Save. To access the report, click the Reports tab on the Search & Reporting navigation bar.
Save as Dashboard Panel Save the chart as a panel on a new or existing dashboard.
Save as Alert Save the chart as an alert.
Clone this Panel Make a copy of the chart. Clone panels and then make adjustments to compare points in your data. Not available for alert panels.
Export as PNG Export the chart as a PNG file.
Export as CSV Export chart values as a CSV file.

Recover workspace charts

Charts in the Metrics Workspace are automatically backed up to your local system. If you accidentally navigate away from the workspace, you have the option to restore your session in the same browser.

Disable automatic chart recovery

You also have the option to disable automatic chart recovery using the workspace.conf file.

  1. Navigate to the packages/splunk_metrics_workspace/src/main/resources/splunk/default directory on your local file system.
  2. Open workspace.conf.
  3. In the features stanza, add the following line: state_restore = 0.
  4. Restart Splunk Enterprise.

If you are using Splunk Cloud, you cannot disable chart recovery.

For more information about saving charts as dashboard panels, see Dashboards in the Splunk Metrics Workspace.

For more information about saving charts as alerts, see Alerts in the Splunk Metrics Workspace.

Last modified on 05 April, 2019
Types of data in the Splunk Metrics Workspace
Time range in the Splunk Metrics Workspace

This documentation applies to the following versions of Splunk® Metrics Workspace (Legacy): 1.0.0, 1.0.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters