Splunk® Enterprise

Search Tutorial

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Create an overlay chart and explore visualization options

In this example, you create a chart that overlays two data series as lines over three data series as columns. The overlay chart will show the Actions and the Conversion Rates.

You will use the stats command to count the user actions. The eval command is used to calculate the conversion rates for those actions. For example, how often someone who viewed a product also added the product to their cart.

Prerequisite
This example uses the productName field from the Enabling field lookups section of this tutorial. You must complete all of those steps before continuing with this section.

Steps

  1. Start a new search.
  2. Change the time range to All time.
  3. Run the following search.

    sourcetype=access_* status=200 | stats count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName | eval viewsToPurchases=(purchases/views)*100 | eval cartToPurchases=(purchases/addtocart)*100 | table productName views addtocart purchases viewsToPurchases cartToPurchases | rename productName AS "Product Name", views AS "Views", addtocart as "Adds To Cart", purchases AS "Purchases"

    The eval command is used to define two new fields. These fields contain the conversion rates.

    • The viewToPurchases field calculates the number of customers who viewed the product to the number of customers who purchased the product. The calculation returns a percentage.
    • The cartToPurchases field calculates the number of customers who added the product to their cart to the number of customers who purchased the product. The calculation returns a percentage.

    This screen image shows the results of the search in a table on the Statistics tab. There are 6 columns: Product Names, Views, Adds To Cart, Purchases, views to Purchase, and cart to Purchases.

    The next few steps reformat the chart visualization to overlay the two data series for the conversion rates, onto the three data series for the actions.

  4. Click the Visualization tab.
    This is the same chart in the section Create a basic chart, with two additional data series, viewsToPurchases and cartToPurchases.
    This screen image shows the search results depicted as a column chart, on the Visualization tab.

    Notice that the labels on the X-Axis are truncated. Because there are so many products, the labels are truncated making them difficult to read. Let's fix that.

  5. Click Format and X-Axis.
    1. For Label Rotation select the second option, which is -45 degrees.
      This screen image shows the Format dialog box. There are 5 tabs in the dialog box: General, X-Axis, Y-Axis, Chart Overlay, and Legend. The options on the X-Axis tab are: Title, Label Rotation, and Label Truncation.
    2. Close the Format dialog box.
      Notice the change in the labels on the X-Axis.
      This screen image shows the results of changing the angle of X-Axis labels. The labels now appear at a 45 degree angle, making them more readable. Before changing the angle, the labels were compressed and truncated.

  6. Look at the numbers on the Y-Axis. The numbers range from 1000 to 3000. Click Format and Y-Axis.
    To make the chart easier to read, add a title and specify different number intervals on the Y-Axis.
    1. For Title, choose Custom and type Actions.
    2. For Interval type 500.
    3. For Max Value type 2500.
      This screen image shows the Format dialog box. The Y-Axis options are: Title, Scale, Interval, Min Value, Max Value, and Number Abbreviations.


    4. Close the Format dialog box. Notice the changes to the label and values on the Y-Axis.
      This screen image shows the changes to the Y-Axis.


  7. Look at the legend. It shows that some of the columns represent actions such as Views and Purchases, and some columns represent conversion rates such as viewsToPurchases. The actions are counts of the values in specific fields. The conversion rates are percentages. These two types of information should be shown separately.
  8. To fix this issue, click Format and Chart Overlay.
    To separate the actions from the conversion rates, you can overly one set of values over another set of values. In this example you will overlay the conversion rates, as lines, over the actions, which will remain as columns.
    1. For Overlay, click inside the box and select viewsToPurchase. Click inside the box again and select cartToPurchase. This identifies the two series that you want to overlay on to the column chart.
    2. For View as Axis, click On.
    3. For Title, choose Custom
      This screen image shows the Format dialog box. The Chart Overlay options are: Overlay, View as Axis, Title, Scale, Interval, Min Value, Max Value, and Number Abbreviations.
    4. Type Conversion Rates.
    5. For Scale, click Linear.
    6. For the Interval type 20. For the Max Value type 100.
    7. Close the Format dialog box. Notice that the conversion rates now appear as lines in the chart. This screen image shows the updated display of the chart on the Visualization tab. There is second Y-Axis for the conversion rates on the right side of the chart

      The axis on the right side of the chart is called a second Y-Axis. The label and values for the line series appear on this axis.
  9. Click Save As and select Report.
    This screen image shows the Save As drop-down list.
    1. In the Save Report As dialog box, for Title type Comparison of Actions and Conversion Rates by Product.
    2. For Description, type The number of times a product is viewed, added to cart, and purchased and the rates of purchases from these actions.
  10. Click Save
  11. In the confirmation dialog box, click View. This screen image shows the saved report.

Next step

Create a report from a custom chart

See also

stats command in the Search Reference
eval command in the Search Reference
Chart overview in Dashboards and Visualizations

Last modified on 24 May, 2019
Create a basic chart   Create a report from a custom chart

This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters