Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF


Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Data for charts

To build any chart, start with a transforming search that generates one or more data series.

A series is a sequence of related data points. These points can be plotted on a chart. For example, each line in a line chart shows one series.

6.4 Line Chart example.png

When you run a transforming search, select the Statistics tab. Review the statistics table to see the series generated. After the first column, each additional column represents a series. A single series search generates two columns. A multiple series search generates three or more columns.

Different chart types are optimized to visualize one or more data series.

Chart name Optimized for single series? Optimized for multiple series? Notes
Pie Yes No Pie charts can only render a single series.
Bar Yes Yes
Column Yes Yes
Line Yes Yes Typically, line charts are used for multiple series.
Area No Yes Use an area chart to render multiple series.
Scatter No Yes Scatter charts work best with two data series.
Bubble No Yes Bubble charts work best with three data series.
Last modified on 22 February, 2018
PREVIOUS
Chart overview 		  NEXT
Pie chart

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters