Add a chart
Splunk provides a variety of chart visualizations, such as column, line, area, scatter, and pie charts. These visualizations require transforming searches (searches that use reporting commands) whose results involve one or more series. For more information on the chart visualizations available, see "Charts" in the Splunk User Manual.
Configure the chart panel
The following example displays information from an inline search as a column chart. The columns in the chart "stack" the data returned from the search.
<dashboard> <label>My dashboard</label> <row> <chart> <searchString> sourcetype=access_* method=GET | timechart count by categoryId | fields _time BOUQUETS FLOWERS </searchString> <title>Views by product category, past week (Stacked)</title> <earliestTime>-7d</earliestTime> <latestTime>now</latestTime> <option name="charting.chart">column</option> <option name="charting.axisTitleX.text">Views</option> <option name="charting.axisTitleY.text">Date</option> </chart> </row> </dashboard>
The inline search is based on a version of the Splunk tutorial. The search for this panel is a transforming search, using reporting commands.
<title> tag displays a title for the panel. The panel also restricts the time range for results reported.
<option> tags specify the type of chart to display, and labels for the X and Y axes.
Set chart specific options
For basic configuration of charts, refer to the "Chart panel entry" in the Panel reference for Simplified XML.
There are many additional configurations you can make to customize the appearance of a chart. Refer to the Splunk Custom Chart Configuration Reference for details. Custom configuration options include:
Step 3: Add panels
Add a table
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7