Use a bubble chart to visualize multiple series data in three dimensions. Bubble position represents two dimensions of the data series. Bubble size represents the third dimension.
To create a bubble chart, start with a search that generates multiple data series. Use this syntax to generate the series.
... | <stats_command> <y-axis_field> <x-axis_field> <bubble_size_field>
A single group-by field in the query generates a visualization with all bubbles in the same color. To get series colors with the
stats command, use two group-by fields. This generates a bubble for each unique combination of those two fields. The value of the second field determines the series color.
Bubble chart configurations include the following options. Use the Format menu to adjust these settings.
- Minimum and maximum bubble marker size
- Axis titles
- X-axis label rotation and truncation
- Axis scale, interval, minimum and maximum values
- Abbreviate y-axis and x-axis numerical values
Create a bubble chart
Review the following details about building column and bar charts.
- Write a search that generates three data series.
- Run the search.
- Select the Statistics tab below the search bar. The statistics table here should have four columns.
- Select the Visualization tab and use the Visualization Picker to select the bubble chart visualization.
- (Optional) Use the Format menu to configure the visualization.
This search aggregates earthquake events by location. It generates data series representing the magnitude, depth, and count for each earthquake location.
source="earthquakes.csv" | stats count by Region, Magnitude, Depth
The search generates a bubble chart where the x-axis and y-axis plot magnitude and depth. The bubble size indicates the relative count value for a particular location.
Event annotations for charts
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.3.0