Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Edit visualizations

The Visualization Editor provides many features to help create and modify visualizations. The visualization you choose to represent your data depends on the results returned from your search query and how you want to depict them.

This topic covers editing visualizations from the Dashboard Editor, as well as from the Search page. You can also use the Pivot Editor, available from Pivot, for editing visualizations. Pivot Editor provides more options for defining a visualization than the Visualization Editor because it matches properties in the visualization with their definition in a pivot. For more information, see Design pivot charts and visualizations with the Pivot Editor.

About the Visualization Editor

The Visualization Editor is available from the following places in Splunk Web.

  • The Panel Editor, when editing a dashboard.
  • Search, from the Visualization tab after running a transforming search.

The Visualization Editor is not a single editor, but instead a set of editing dialogs that allow you to select and modify a visualization. The editing features available depend on whether you are editing the visualization from the Panel Editor or from Search.

The contents of the editing dialogs also differ, depending on the search results for the visualization and on the visualizations selected for those results.

The Visualization Editor contain these dialogs:

  • Visualization Picker
    Select a visualization from a dropdown list. Splunk recommends some visualizations, depending on the source search. Some visualizations that are available to select may not be appropriate for the search results.

    The icon representing the Visualization Picker reflects the currently selected visualization.
  • Visualization Formatting
    Allows you to specify options for the selected visualization. The options available depend on the visualization selected.
  • Search Editor
    Available only from the Panel Editor. Allows you to modify the base search or report that generates results for the panel.

Open the Visualization Editor

How you open the Visualization Editor depends on whether you are editing a dashboard or viewing results in Search.

Dashboard Editor

In the Dashboard Editor, you can only edit panels in dashboards for which you have write permission. If you have read-only access to a dashboard, you cannot change the appearance of any panels in that dashboard. By default you have write permission for any dashboard that you create using the Dashboard Editor. However, an admin user can change that permission.

Open the Visualization Editor for a panel in a dashboard:

  1. For a dashboard, select Edit > Edit Panels to enable the dashboard for editing.
  2. Select the appropriate icon for the panel you want to edit.
  • Panel properties icon: Edit the base search for the panel.
  • Visualization icon: Change the visualization.
  • Visualization Formatting icon: Configure the selected visualization.

Search page

From the Search page, open the Visualization Editor after you get results from your query. The search query must be a transforming search, as described in About transforming commands..

After running a search in Search select the appropriate icon to edit the visualization.

  • Visualization icon: Change the visualization.
  • Visualization Formatting icon: Configure the selected visualization.

Edit visualizations

Each visualization contains a set of configuration properties that you can modify. Many charts share the same properties but some properties only apply to specific types of charts. This section provides a brief description of the chart properties available for editing.

For more information on visualization properties, refer to:

General

General properties vary, depending on the visualization.

Area, Bar, Column, Line charts

Viz GeneralPropsColumn 6.1.png


  • Stack mode (Column, Bar, and Area)
    How to represent data in the chart. Options are:
Not Stacked
Stacked
Stacked 100%.
  • Multi-series mode
    Enable or disable multi-series mode.
  • Null value (Area, Line)
    Specify how to represent missing Y axis values. Options are:
Gaps: Do not connect to data points that have a value of 0 or less, or only connect to the next data point.
Zero: Connect missing data points to zero.
Connect: Connect to the next data point.

Pie, Scatter charts

Viz GeneralPropsPie.png


Single Value

Viz GeneralPropsSingle.png


  • Before Label: Text to display before the value.
  • After Label: Text to display after the value.
  • Under Label: Text to display beneath the value.

Filler, Marker, and Radial Gauges

Viz GeneralPropsRadialGauge.png


  • Style:
Minimal: A "just the basics" version of the gauge.
Shiny: A graphically stylized version of the gauge with with chrome, shading, and other features to model a real world gauge.

X Axis

Specify the properties for the X Axis of a chart.

Area, Bar, Column, Line, and Scatter charts

Viz X AxisPropsColumn 6.1.png


  • Title: Specify a title for the X-axis. Choose one of the following:
Default: The title derives from the search for the panel.
Custom: Enter a custom title in the text box.
None: Do not display a title.
  • Label Rotation: Set how labels appear under the columns.

Y Axis

Specify properties for the Y-axis of a chart.

Area, Bar, Column, Line, and Scatter charts

Viz Y AxisPropsColumn 6.1.png


  • Title: Specify a title for the Y-axis. Choose one of the following:
Default: The title derives from the search for the panel.
Custom: Enter a custom title in the text box.
None: Do not display a title.
  • Scale: Select Linear or Log. Log provides a logarithmic scale, useful for minimizing the display of large peak values.
  • Interval: Enter the units between tick marks in the axis.
  • Min Value: The minimum value to display. Values less than the Min Value do not appear on the chart.
  • Max Value: The maximum value to display. Values greater than the Max Value do not appear on the chart.

Chart Overlay

Specify properties for a chart overlay. See Chart overlay for implementation details.

Area, Column, and Line charts

Viz LegendPropsOverlay 6.1.png

  • Overlay: Select a field to show as an overlay
  • View as Axis: Select On to map the overlay to a second Y-axis.
  • Title: Specify a title for the overlay.
  • Scale: Select Inherit, Linear, or Log. Inherit uses the scale for the base chart. Log provides a logarithmic scale, useful for minimizing the display of large peak values.
  • Interval: Enter the units between tick marks in the axis.
  • Min Value: The minimum value to display. Values less than the Min Value do not appear on the chart.
  • Max Value: The maximum value to display. Values greater than the Max Value do not appear on the chart.

Legend

Specify properties for the chart legend.

Area, Bar, Column, Line, Scatter charts

Viz LegendPropsColumn 6.1.png

  • Position: Where to place the legend (or to not include the legend) in the visualization.
  • Truncation: How to represent names that are too long to display:
Truncate End: Elide final characters.
Truncate Middle: Elide middle characters.
Truncate Start: Elide initial characters.

Single Value and Gauges

For data returned as a single value, Splunk provides a Single Value visualization and various styles of gauges (Radial, Filler, and Marker). You can specify the following features for these visualizations:

Single Value (General)

Viz GeneralPropsSingle.png


  • Before Label: Text to display before the value.
  • After Label: Text to display after the value.
  • Under Label: Text to display beneath the value.

Filler, Marker, and Radial Gauges (General)

Viz GeneralPropsRadialGauge.png


  • Style:
Minimal: A "just the basics" version of the gauge.
Shiny: A graphically stylized version of the gauge with with chrome, shading, and other features to mimic a real world gauge.

Filler, Marker, and Radial Gauges (Color Range)

Viz ColorRangeGauge.png


  • Color ranges:
Automatic: Splunk determines the size and color of returned value ranges.
Manual: Specify colors and the value range they represent.

Maps

To create a map visualization, create a panel in a dashboard that uses the geostats search command. For information on the geostats command, see geostats in the Search Reference.

Here are two examples of inline searches. The first uses a lookup table provided with your Splunk Enterprise distribution. The second references map data available from foursquare.

| inputlookup mapdata.csv | geostats latfield=latitude longfield=longitude sum(count) as count

sourcetype=foursquare | geostats latfield=checkin.geolat longfield=checkin.geolong count by checkin.user.gender

The Visualization Editor provides editing fields for the basic properties of a map. Additional properties are available when you edit a map from the simple XML source. Refer to the Map entry in the Simple XML reference for all properties available for editing maps.

Map drilldown

From General properties, you can enable or disable drilldown behavior.

Viz MapGeneral.png

Map initial settings

From Map properties specify the initial center point coordinates and the initial zoom level.

Viz MapMap.png

  • Latitude:
    Value for the initial center point. Latitude values can range from -85 to 85, with values outside of this range being clipped.
  • Longitude:
    Value for the initial center point. Longitude values can range from -180 to 180, with values outside of this range being clipped.
  • Zoom:
    The initial zoom level of the map.
    Seven is the maximum zoom level of the default map tile set provided with Splunk. Select a different tile set for greater zoom capabilities.
  • Populate with current map settings
    In the map, you can pan to a location and zoom level. Select Populate with current map settings to preserve these settings as the initial settings for the map.

Map marker settings

From Markers properties, you can define the opacity and size of markers. You can also specify the maximum number of marker clusters.

Viz MapMarkers.png

  • Opacity
    Specify the opacity of the markers. Values can range from 0% (transparent) to 100% (opaque).
  • Min Size
    The minimum size of the markers, in pixels.
  • Max Size
    The maximum size of the markers, in pixels.
  • Max Clusters
    The maximum number of clusters to render.
    Caution: Setting this option to a large number of clusters can significantly degrade performance. Splunk recommends values below 1000.

Map Tiles

Splunk provides a default tile set based on the Leaflet open source JavaScript library for interactive maps. You can specify other tile sets based on Leaflet.

From Tiles specify a location to request map tiles. You can also specify zoom limits for the tiles.

Viz MapTiles.png

  • URL
    Specify the URL to use for requesting map tiles. If left blank, use the Splunk tiles.
  • Min Zoom
    The minimum zoom level of the tile set.
  • Max Zoom
    The maximum zoom level of the tile set.
  • Populate from preset configuration
    Select a tile set from configurations available. For this release, Splunk provides a default tile set as well as a link to the tile set available from Open Street Map.
PREVIOUS
Create and edit forms with the Dashboard Editor
  NEXT
Convert a dashboard to HTML

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters