Splunk® Enterprise

Search Tutorial

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Create an overlay chart and explore visualization options

In this example, you create a chart that overlays two data series as lines over three data series as columns. The overlay chart will show Actions such as Adds To Cart and Purchases on one type of chart and the Conversion Rates, such as Views To Purchases, in another type of chart.

You will use the stats command to count the user actions. The eval command is used to calculate the conversion rates for those actions. For example, how often someone who viewed a product also added the product to their cart.

This example uses the productName field from the Enabling field lookups section of this tutorial.
If you do not configure the field lookups, the searches in this section will not produce the correct results.

Let's start by a running a search and viewing the results as a chart.

  1. Start a new search.
  2. Change the time range to All time.
  3. Run the following search.

    sourcetype=access_* status=200 | stats count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName | eval viewsToPurchases=(purchases/views)*100 | eval cartToPurchases=(purchases/addtocart)*100 | table productName views addtocart purchases viewsToPurchases cartToPurchases | rename productName AS "Product Name", views AS "Views", addtocart as "Adds To Cart", purchases AS "Purchases"

    The eval command is used to define two new fields. These fields contain the conversion rates.

    • The viewToPurchases field calculates the number of customers who viewed the product to the number of customers who purchased the product. The calculation returns a percentage.
    • The cartToPurchases field calculates the number of customers who added the product to their cart to the number of customers who purchased the product. The calculation returns a percentage.


    This screen image shows the results of the search in a table on the Statistics tab. There are 6 columns: Product Names, Views, Adds To Cart, Purchases, views to Purchase, and cart to Purchases.

  4. Click the Visualization tab.
    This is the same chart in the section Create a basic chart, with two additional data series, viewsToPurchases and cartToPurchases.

    This screen image shows the search results depicted as a column chart, on the Visualization tab.

The next few steps reformat the chart visualization to overlay the two data series for the conversion rates, onto the three data series for the actions.

Format the X-Axis labels

Notice that the labels on the X-Axis are truncated. Because there are so many products, the labels are truncated making them difficult to read. Let's fix that.

  1. Click Format and X-Axis.
  2. For Label Rotation select the second option, which is -45 degrees.

    This screen image shows the Format dialog box. There are 5 tabs in the dialog box: General, X-Axis, Y-Axis, Chart Overlay, and Legend. The options on the X-Axis tab are: Title, Label Rotation, and Label Truncation.

  3. Close the Format dialog box.
    Notice the change in the labels on the X-Axis.

    This screen image shows the results of changing the angle of X-Axis labels. The labels now appear at a 45 degree angle, making them more readable. Before changing the angle, the labels were compressed and truncated.

Format the Y-Axis values and add a title

Look at the numbers on the Y-Axis. The numbers range from 1000 to 3000 and there is no title to identify what that axis tracks. Let's make the chart easier to read,

  1. Click Format and Y-Axis.
    We're going to add a title and specify different number intervals on the Y-Axis.
  2. For Title, choose Custom and type Actions.
  3. For Interval type 500.
  4. For Max Value type 2500.

    This screen image shows the Format dialog box. The Y-Axis options are: Title, Scale, Interval, Min Value, Max Value, and Number Abbreviations.

  5. Close the Format dialog box. Notice the changes to the label and values on the Y-Axis.

    This screen image shows the changes to the Y-Axis.

Format the second Y-Axis

Look at the legend. It shows that some of the columns represent actions such as Views and Purchases, and some columns represent conversion rates such as viewsToPurchases. The actions are counts of the values in specific fields. The conversion rates are percentages. These two types of information should be shown separately.

  1. To fix this issue, click Format and Chart Overlay.
    To separate the actions from the conversion rates, you can overly one set of values over another set of values. In this example you will overlay the conversion rates, as lines, over the actions, which will remain as columns.
  2. For Overlay, click inside the box. Begin and select viewsToPurchase. Click inside the box again and select cartToPurchase. This identifies the two series that you want to overlay on to the column chart.
  3. For View as Axis, click On.
  4. For Title, choose Custom

    This screen image shows the Format dialog box. The Chart Overlay options are: Overlay, View as Axis, Title, Scale, Interval, Min Value, Max Value, and Number Abbreviations.

  5. Type Conversion Rates.
  6. For Scale, click Linear.
  7. For the Interval type 20. For the Max Value type 100.
  8. Close the Format dialog box. Notice that the conversion rates now appear as lines in the chart.

    This screen image shows the updated display of the chart on the Visualization tab. There is second Y-Axis for the conversion rates on the right side of the chart


The axis on the right side of the chart is called a second Y-Axis. The label and values for the line series appear on this axis.

Save the revised chart as a report

You've made great changes to the chart to make it more readable. Now it's time to save the chart as a report.

  1. Click Save As and select Report.

    This screen image shows the Save As drop-down list.

  2. In the Save Report As dialog box, for Title type Comparison of Actions and Conversion Rates by Product.
  3. For Description, type The number of times a product is viewed, added to cart, and purchased and the rates of purchases from these actions.
  4. Click Save
  5. In the confirmation dialog box, click View.

    This screen image shows the saved report.

Next step

Create a report from a custom chart

See also

stats command in the Search Reference
eval command in the Search Reference
Chart overview in Dashboards and Visualizations

Last modified on 28 October, 2021
PREVIOUS
Create a basic chart
  NEXT
Create a report from a custom chart

This documentation applies to the following versions of Splunk® Enterprise: 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters