Splunk® Enterprise

Search Tutorial

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Create an overlay chart and explore visualization options

In this example, you create a chart that overlays two data series as lines over three data series as columns. The overlay chart will show the Actions and the Conversion Rates.

You will use the stats command to count the user actions. The eval command is used to calculate the conversion rates for those actions. For example, how often someone who viewed a product also added the product to their cart.

Prerequisite
This example uses the productName field from the Enabling field lookups section of this tutorial. You must complete all of those steps before continuing with this section.

Steps

  1. Start a new search.
  2. Change the time range to All time.
  3. Run the following search.

    sourcetype=access_* status=200 | stats count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName | eval viewsToPurchases=(purchases/views)*100 | eval cartToPurchases=(purchases/addtocart)*100 | table productName views addtocart purchases viewsToPurchases cartToPurchases | rename productName AS "Product Name", views AS "Views", addtocart as "Adds To Cart", purchases AS "Purchases"

    The eval command is used to define two new fields. These fields contain the conversion rates.

    • The viewToPurchases field calculates the number of customers who viewed the product to the number of customers who purchased the product. The calculation returns a percentage.
    • The cartToPurchases field calculates the number of customers who added the product to their cart to the number of customers who purchased the product. The calculation returns a percentage.


    This screen image shows the results of the search.
    The next few steps reformat the chart visualization to overlay the two data series for the conversion rates, onto the three data series for the actions.
  4. Click the Visualization tab.
    This is the same chart in Create a basic chart, with two additional data series, viewsToPurchase and cartToPurchase.
    This screen image shows the search results depicted as a column chart, on the Visualization tab.
    Notice the labels on the X-Axis. are truncated. Because there are so many products, the labels are truncated making them difficult to read. Let's fix that.
  5. Click Format and X-Axis.
    1. Rotate the label -45 degrees.
      This screen image shows the Format dialog box. The options on the X-Axis tab are filled in as specified in the steps above.
    2. Close the Format dialog box.
      Notice the change in the labels on the X-Axis.
      This screen image shows the results of changing the angle of X-Axis labels. The labels now appear at a 45 degree angle, making them more readable. Before changing the angle, the labels were compressed and truncated.
  6. Look at the numbers on the Y-Axis. They range from 1000 to 3000. Click Format and Y-Axis.
    To make the chart easier to read, add a label and specify different number intervals on the Y-Axis.
    1. For Title, choose Custom and type Actions.
    2. For Interval type 500.
    3. For Max Value type 2500.
      This screen image shows the Format dialog box. The options on the Y-Axis tab are filled in as specified in the steps above.
    4. Close the Format dialog box. Notice the changes to the label and values on the Y-Axis.
    5. This screen image shows the changes to the Y-Axis.
  7. Look at the legend. It shows that some of the columns represent actions and some columns represent conversion rates.
  8. To fix this issue, click Format and Chart Overlay.
    To separate the actions (views, adds to cart, and purchases) from the conversion rates (viewToPurchases and cartToPurchases), you can overly one set of values over another set of values. In this example you will overlay the conversion rates, as lines, over the actions, which will remain as columns.
    1. For Overlay, click inside the box. Begin and select viewsToPurchase. Click inside the box again and select cartToPurchase.
    2. For View as Axis, click On.
    3. For Title, choose Custom
      This screen image shows the Format dialog box. The options on the Chart Overlay are displayed.
    4. Type Conversion Rates.
    5. For Scale, click Linear.
    6. For the Interval type 20. For the Max Value type 100.
    7. Close the Format dialog box. Notice that the conversion rates now appear as lines in the chart.
    8. This screen image shows the updated display of the chart on the Visualization tab.
      The axis on the right side of the chart is called the second Y-Axis. The label and values for the line series appear on this axis.
  9. Click Save As and select Report.
    This screen image shows the updated Save As drop-down.
    1. In the Save Report As dialog box, for Title type Comparison of Actions and Conversion Rates by Product.
    2. For Description, type The number of times a product is viewed, added to cart, and purchased and the rates of purchases from these actions.
  10. Click Save
  11. In the confirmation dialog box, click View.
    This screen image shows the saved report.

Next step

Create a report from a custom chart

See also

stats command in the Search Reference
eval command in the Search Reference
Chart overview in Dashboards and Visualizations

Last modified on 26 March, 2018
Create a basic chart   Create a report from a custom chart

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters