Splunk® Enterprise

Splunk Dashboard Studio

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Part 5 Add a column chart

Let's say that you want to show how the number of purchases at Buttercup Games changes over a particular time. Similarly, you want to show this same metric, but broken down into game categories, such as arcade, shooter, and sports. In this part of the tutorial, create a column chart using a chain search.

  1. Select the add chart icon (A bar graph as an icon.) in the editing toolbar, and then select Column.
  2. In the New Data Source panel, name the source Purchase Trends.
  3. Add your search. For this tutorial, copy and paste the following search into the Search with SPL box:
    index=main sourcetype=access_* status=200 action=purchase categoryId!=NULL
    | fields _time categoryId clientip
    | timechart count by categoryId
    
  4. Expand the Code section and change the Data Source ID to ds_purchase_trends.
  5. Select Apply & Close
  6. Title your chart Purchase Trends and leave the description box empty.
  7. In the General section of the Configuration panel, follow these steps:
    1. Change the Background to transparent.
    2. Select the stacked icon (Two vertical bars with their top halves a darker shade than their bottom halves.) option for Stack Mode. The stacked option builds the area for each value vertically instead of creating layers beginning at the x-axis.
  8. In the Legend section, change the Position option to Bottom.
  9. Expand the Code section and change the Visualization ID to viz_purchase_trends.
  10. Move and resize your column chart to the center of the bottom right gray rectangle.

After completing Part 5, your column chart will look similar to the following: Column chart showing purchases over time and categorized by game type.


Next step

You've completed Part 5 of the Splunk Dashboard Studio tutorial.

Now your dashboard has a column chart. Next, add a single value visualization with a chain search. Continue to Part 6: Add a single value visualization using a chain search.

Last modified on 22 July, 2022
PREVIOUS
Part 4 Add a pie chart visualization
  NEXT
Part 6 Add a single value visualization using a chain search

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters