Part 5 Add a column chart

Let's say that you want to show how the number of purchases at Buttercup Games changes over a particular time. Similarly, you want to show this same metric, but broken down into game categories, such as arcade, shooter, and sports. In this part of the tutorial, create a column chart using a chain search.

1. Select the add chart icon () in the editing toolbar, and then select Column.
2. In the New Data Source panel, name the source Purchase Trends.
3. Add your search. For this tutorial, copy and paste the following search into the Search with SPL box:

   index=main sourcetype=access_* status=200 action=purchase categoryId!=NULL
   | fields _time categoryId clientip
   | timechart count by categoryId
   

4. Expand the Code section and change the Data Source ID to ds_purchase_trends.
5. Select Apply & Close
6. Title your chart Purchase Trends and leave the description box empty.
7. In the General section of the Configuration panel, follow these steps:
   1. Change the Background to transparent.
   2. Select the stacked icon () option for Stack Mode. The stacked option builds the area for each value vertically instead of creating layers beginning at the x-axis.
8. In the Legend section, change the Position option to Bottom.
9. Expand the Code section and change the Visualization ID to viz_purchase_trends.
10. Move and resize your column chart to the center of the bottom right gray rectangle.

After completing Part 5, your column chart will look similar to the following:

Next step

You've completed Part 5 of the Splunk Dashboard Studio tutorial.

Now your dashboard has a column chart. Next, add a single value visualization with a chain search. Continue to Part 6: Add a single value visualization using a chain search.