Format table visualizations

Use the Format menu to configure a table visualization.

Add summary statistics

Use the Format menu Summary tab to include column totals and percentages. For each statistic, a highlighted summary row appears at the bottom of the table. Column totals and/or percentages appear at the bottom of each column that contains numeric values.

Note: Values in a summary row reflect statistics for the complete search result set. For tables with more than one page of results, summary row values do not apply only to the currently displayed page.

Summary and data row differences

There are some behavior and formatting differences between summary rows and data rows in a table.

Behavior or format	Summary rows	Data rows
Static highlight color	Yes	No
Values in the row can skew table color formatting or data overlay	No	Yes
Column number formatting applied to the row	Yes	Yes
Drilldown available for the row	No	Yes
Included in PDF or CSV export	No	Yes

Totals data row behavior

A static summary row fits most use cases. If you generate a totals data row using the addcoltotals SPL command in a search, note the following table behavior impacts.

• An addcoltotals row is treated as a data row in the table.
• Because they are handled as data rows, addcoltotals rows are included in a PDF or CSV dashboard export.
• Color scales or data overlay can be skewed if a table includes an addcoltotals data row.
• Tables should not include an addcoltotals data row and a column totals summary row. If you opt to include a totals summary row, adjust the search to remove the addcoltotals command.

Summary row examples

The following examples show use case scenarios for adding column totals and percentage rows to a table.

Totals summary row

An analyst for an online retailer is evaluating how customer actions, such as purchases or quantity changes, relate to product types. The analyst is also comparing the relative frequency of different customer actions.

The following query generates a table showing product type counts for each customer action.

... | chart count(itemId) over categoryId by action 

Using the Format menu, the analyst adds a totals summary row to the table.

The totals row shows relative totals for each customer action. For instance, there were 952 purchase events in the results set, compared to 98 product removal events.

Percentage summary row

An analyst creates a table showing purchasing activity on a retail website. The following query generates results comparing purchases for different product types.

... | chart count(itemId) over action by categoryId

The analyst uses the Format menu to include a percentage row in the table.

This row shows a percentage for each product type relative to all purchases. For example, arcade games make up 19.4 percent of all purchases.

Format table columns

You can format individual table columns to add context or focus to the visualization. Click on the paintbrush icon at the top of each column to customize color and number formatting.

Note: Column formatting is not available for columns representing the _time field or for sparkline columns.

Column color

Select and configure one of the following color modes for the column.

Note: Column color formatting overrides existing heat map or high/low value data overlay settings.

Scale

Use a sequential or divergent color scale on column cells. You can choose a preset scale or a custom configuration to manage how colors in the scale are applied to column cells.

Depending on search results and data distribution, column color gradation can vary. Columns with relatively similar values will show the most color gradation. Outlying values can limit the gradation.

Color scale options

Scale type	Description	Example
Sequential	Use a sequential scale to show how results approach a high value in the column.	This example column has sequential coloring. It is also sorted to show the highest values at the top.
Divergent	A divergent scale can show how results approach high and low values.	This example column has divergent coloring. It shows the lowest values at the top and the highest values at the bottom.

Configure a custom color scale
You can configure custom color handling by indicating minimum, midpoint, and maximum value colors. Use one of the following options to configure the minimum, midpoint, and maximum value interpretation for the color scale.

Configuration options

Option	Description	Use case example
Highest and lowest values	This option highlights the highest and lowest values in the column.	Show which products had the most purchases in a sales data set. Show how recent customer satisfaction survey results trended towards highest and lowest scores.
Number	Indicate numeric value thresholds. Cell color is determined according to how values align with the three thresholds.	Show department course enrollment according to small, medium, and large roster size.
Percent	Determine cell color using percentages of the results value range.	Show student test scores on a final exam.
Percentile	Determine cell color using percentiles of the results value distribution.	Compare customer satisfaction survey results.

Ranges

Apply color to cells in this column according to value ranges.

Use ranges to compare cell values categorically. For example, use red, yellow and green range colors to indicate low, medium, and high sales results.

Range configuration options:

• Adjust the default range value and color settings.
• Add or remove ranges.

Values

Apply colors according to cell values.

Use automatic value coloring or define custom rules. Automatic coloring applies a color to every cell in the column. Cells with the same value appear in the same color.

Custom rules can help highlight specific values that you are monitoring. For example, use custom rules to highlight three new products in recent sales data.

Number format

Enable and adjust number formatting for each column. The number format settings panel includes the following options.

• Enable or disable number formatting.
• Set decimal precision.
• Opt to use thousand separators.
• Specify a measurement unit to add context to the values in this column. You can position the unit before or after each value.

Configure table properties

After generating a table, use the Format menu to configure one or more of the following table components.

• The number of rows shown in each table page
• Wrapping
• Table row number display

Data overlay

The Format menu also includes the following data overlay options.

Heat map
Add different shades of a particular color to the table to show value variation over table rows.

High and low value
Add high and low value colors to the table to highlight the highest and lowest values.

Use data overlay only if you are not adding column color formatting to the table. Column color formatting overrides data overlay configurations.

Drilldown

By default, drilldown is disabled when you save visualizations to a dashboard. You can use the drilldown editor or Simple XML to enable and configure drilldown options. For example, use drilldown to link to Splunk Answers posts relevant to the value users click in a table cell. See Use drilldown for dashboard interactivity for more details on enabling and configuring drilldown.

Simple XML drilldown options
In Simple XML, you can set the drilldown option to one of the following values. Use the <drilldown> element to change the drilldown behavior.

Option	Behavior
Cell	By default, opens a secondary search using the field and value in the selected cell.
Row	By default, opens a secondary search using the field and values from cells in the selected row.
None	Disables drilldown.