Edit visualizations

The Visualization Editor provides many features to help create and modify visualizations. The visualization you choose to represent your data depends on the results returned from your search query and how you want to depict them.

This topic covers editing visualizations from the Dashboard Editor, as well as from the Search page. You can also use the Pivot Editor, available from Pivot, for editing visualizations. Pivot Editor provides more options for defining a visualization than the Visualization Editor because it matches properties in the visualization with their definition in a pivot. For more information, see Design pivot charts and visualizations with the Pivot Editor.

About the Visualization Editor

The Visualization Editor is available from the following places in Splunk Web.

• The Panel Editor, when editing a dashboard.
• Search, from the Visualization tab after running a transforming search.

The Visualization Editor is not a single editor, but instead a set of editing dialogs that allow you to select and modify a visualization. The editing features available depend on whether you are editing the visualization from the Panel Editor or from Search.

The contents of the editing dialogs also differ, depending on the search results for the visualization and on the visualizations selected for those results.

The Visualization Editor contain these dialogs:

• Visualization Picker
  Select a visualization from a dropdown list. Splunk recommends some visualizations, depending on the source search. Some visualizations that are available to select may not be appropriate for the search results.
  
  The icon representing the Visualization Picker reflects the currently selected visualization.

• Visualization Formatting
  Allows you to specify options for the selected visualization. The options available depend on the visualization selected.

• Search Editor
  Available only from the Panel Editor. Allows you to modify the base search or report that generates results for the panel.

Open the Visualization Editor

How you open the Visualization Editor depends on whether you are editing a dashboard or viewing results in Search.

Dashboard Editor

In the Dashboard Editor, you can only edit panels in dashboards for which you have write permission. If you have read-only access to a dashboard, you cannot change the appearance of any panels in that dashboard. By default you have write permission for any dashboard that you create using the Dashboard Editor. However, an admin user can change that permission.

Open the Visualization Editor for a panel in a dashboard:

1. For a dashboard, select Edit > Edit Panels to enable the dashboard for editing.
2. Select the appropriate icon for the panel you want to edit.

• Panel properties icon: Edit the base search for the panel.
• Visualization icon: Change the visualization.
• Visualization Formatting icon: Configure the selected visualization.

Search page

From the Search page, open the Visualization Editor after you get results from your query. The search query must be a transforming search, as described in About transforming commands..

After running a search in Search select the appropriate icon to edit the visualization.

• Visualization icon: Change the visualization.
• Visualization Formatting icon: Configure the selected visualization.

Edit visualizations

Each visualization contains a set of configuration properties that you can modify. Many charts share the same properties but some properties only apply to specific types of charts. This section provides a brief description of the chart properties available for editing.

For more information on visualization properties, refer to:

• Visualization Reference
• Chart Configuration Reference

General

General properties vary, depending on the visualization.

Area, Bar, Column, Line charts

• Stack mode (Column, Bar, and Area)
  How to represent data in the chart. Options are:

Not Stacked

Stacked

Stacked 100%.

• Drilldown
  Enable drilldown functionality for the visualization. In the case of tables, you can enable drilldown for rows or cells. For more information, see Understand basic table and chart drilldown actions.

• Multi-series mode
  Enable or disable multi-series mode.

• Null value (Area, Line)
  Specify how to represent missing Y axis values. Options are:

Gaps: Do not connect to data points that have a value of 0 or less, or only connect to the next data point.

Zero: Connect missing data points to zero.

Connect: Connect to the next data point.

Pie, Scatter charts

• Drilldown
  Enable drilldown functionality for the visualization. For more information, see Drilldown behavior.

Single Value

• Before Label: Text to display before the value.
• After Label: Text to display after the value.
• Under Label: Text to display beneath the value.

Filler, Marker, and Radial Gauges

• Style:
  

Minimal: A "just the basics" version of the gauge.

Shiny: A graphically stylized version of the gauge with with chrome, shading, and other features to model a real world gauge.

X Axis

Specify the properties for the X Axis of a chart.

Area, Bar, Column, Line, and Scatter charts

• Title: Specify a title for the X-axis. Choose one of the following:

Default: The title derives from the search for the panel.

Custom: Enter a custom title in the text box.

None: Do not display a title.

• Label Rotation: Set how labels appear under the columns.

Y Axis

Specify properties for the Y-axis of a chart.

Area, Bar, Column, Line, and Scatter charts

• Title: Specify a title for the Y-axis. Choose one of the following:

Default: The title derives from the search for the panel.

Custom: Enter a custom title in the text box.

None: Do not display a title.

• Scale: Select Linear or Log. Log provides a logarithmic scale, useful for minimizing the display of large peak values.
• Interval: Enter the units between tick marks in the axis.
• Min Value: The minimum value to display. Values less than the Min Value do not appear on the chart.
• Max Value: The maximum value to display. Values greater than the Max Value do not appear on the chart.

Chart Overlay

Specify properties for a chart overlay. See Chart overlay for implementation details.

Area, Column, and Line charts

• Overlay: Select a field to show as an overlay
• View as Axis: Select On to map the overlay to a second Y-axis.
• Title: Specify a title for the overlay.
• Scale: Select Inherit, Linear, or Log. Inherit uses the scale for the base chart. Log provides a logarithmic scale, useful for minimizing the display of large peak values.
• Interval: Enter the units between tick marks in the axis.
• Min Value: The minimum value to display. Values less than the Min Value do not appear on the chart.
• Max Value: The maximum value to display. Values greater than the Max Value do not appear on the chart.

Legend

Specify properties for the chart legend.

Area, Bar, Column, Line, Scatter charts

• Position: Where to place the legend (or to not include the legend) in the visualization.
• Truncation: How to represent names that are too long to display:

Truncate End: Elide final characters.

Truncate Middle: Elide middle characters.

Truncate Start: Elide initial characters.

Single Value and Gauges

For data returned as a single value, Splunk provides a Single Value visualization and various styles of gauges (Radial, Filler, and Marker). You can specify the following features for these visualizations:

Single Value (General)

• Before Label: Text to display before the value.
• After Label: Text to display after the value.
• Under Label: Text to display beneath the value.

Filler, Marker, and Radial Gauges (General)

• Style:
  

Minimal: A "just the basics" version of the gauge.

Shiny: A graphically stylized version of the gauge with with chrome, shading, and other features to mimic a real world gauge.

Filler, Marker, and Radial Gauges (Color Range)

• Color ranges:
  

Automatic: Splunk determines the size and color of returned value ranges.

Manual: Specify colors and the value range they represent.

Maps

To create a map visualization, create a panel in a dashboard that uses the geostats search command. For information on the geostats command, see geostats in the Search Reference.

Here are two examples of inline searches.

| inputlookup <filename>.csv | geostats latfield=latitude longfield=longitude sum(count) as count

sourcetype=foursquare | geostats latfield=checkin.geolat longfield=checkin.geolong count by checkin.user.gender

The Visualization Editor provides editing fields for the basic properties of a map. Additional properties are available when you edit a map from the simple XML source. Refer to the Map entry in the Simple XML reference for all properties available for editing maps.

Map drilldown

From General properties, you can enable or disable drilldown behavior.

Map initial settings

From General properties specify the initial center point coordinates and the initial zoom level.

• Latitude:
  Value for the initial center point. Latitude values can range from -85 to 85, with values outside of this range being clipped.

• Longitude:
  Value for the initial center point. Longitude values can range from -180 to 180, with values outside of this range being clipped.

• Zoom:
  The initial zoom level of the map.
  Seven is the maximum zoom level of the default map tile set. Select a different tile set for greater zoom capabilities.

• Populate with current map settings
  In the map, you can pan to a location and zoom level. Select Populate with current map settings to preserve these settings as the initial settings for the map.

• Zoom on Scroll:
  Enable zoom behavior when a user scrolls within the map.

Map marker settings

From Markers properties, you can define the opacity and size of markers. You can also specify the maximum number of marker clusters.

• Opacity
  Specify the opacity of the markers. Values can range from 0% (transparent) to 100% (opaque).

• Min Size
  The minimum size of the markers, in pixels.

• Max Size
  The maximum size of the markers, in pixels.

• Max Clusters
  The maximum number of clusters to render.
  Caution: Setting this option to a large number of clusters can significantly degrade performance. If possible, use values below 1000.

Map Tiles

From Tiles specify a location to request map tiles. You can also specify zoom limits for the tiles.

• URL
  Specify the URL to use for requesting alternative map tiles.

• Min Zoom
  The minimum zoom level of the tile set.

• Max Zoom
  The maximum zoom level of the tile set.

• Populate from preset configuration
  Select a tile set from configurations available.