Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Add a chart

Splunk provides a variety of chart visualizations, such as column, line, area, scatter, and pie charts. These visualizations require transforming searches (searches that use reporting commands) whose results involve one or more series. For more information on the chart visualizations available, see "Charts" in the Splunk User Manual.

Configure the chart panel

The following example displays information from an inline search as a column chart. The columns in the chart "stack" the data returned from the search.

 <label>My dashboard</label>

         sourcetype=access_* method=GET | timechart count by categoryId
         | fields _time BOUQUETS FLOWERS
      <title>Views by product category, past week (Stacked)</title>
      <option name="charting.chart">column</option>
      <option name="charting.axisTitleX.text">Views</option>
      <option name="charting.axisTitleY.text">Date</option>


The inline search is based on a version of the Splunk tutorial. The search for this panel is a transforming search, using reporting commands.

The <title> tag displays a title for the panel. The panel also restricts the time range for results reported.

The three <option> tags specify the type of chart to display, and labels for the X and Y axes.

Set chart specific options

For basic configuration of charts, refer to the "Chart panel entry" in the Panel reference for Simplified XML.

There are many additional configurations you can make to customize the appearance of a chart. Refer to the Splunk Custom Chart Configuration Reference for details. Custom configuration options include:

Step 3: Add panels
Add a table

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters