Skip to main content
Splunk® Enterprise

Splunk Dashboard Studio

Splunk® Enterprise
9.1.7

Bar and column charts

Use column and bar charts to compare field values across a data set.

A bar chart


Data formatting

Column and bar charts represent one or more data series. To make sure that a search generates one or more series, check the Statistics tab in Search & Reporting. The table should have at least two columns.

Search results not structured as a table with valid x-axis or y-axis values cannot generate column or bar charts. For example, using the eval or fields commands might change search result structure.

Statistics table order and chart axis

Column and bar charts each use the Statistics table values in different ways. Column charts get x-axis values from the first column in the table. The next table columns contain y-axis values.

Bar charts get y-axis values from the first column in the table. The next table columns contain x-axis values.

As an example, any search using the timechart reporting command generates a table where _time is the first column. A column chart generated with this search has a _time x-axis. A bar chart using this search has a _time y-axis.

Single and multiple data series

Column and bar charts can visualize single or multiple data series. The following examples show you how to generate these series.

Single series

This search compares the activity of different Splunk users. In this search, the over operator indicates that user is the first table column.

index=_internal|chart count over user

The search produces the following table.

A single series table.

Column and bar charts represent this single series differently.

Column chart
X-axis user values are placed horizontally . The y-axis count values are placed vertically.
Bar chart
X-axis user values are placed vertically. The bar chart y-axis count values are placed horizontally.

Multiple data series

To generate multiple data series, you can also change the query to introduce a split-by field. For example, change the previous single series search by adding sourcetype as a split-by field.

...| chart count over user by sourcetype

The split-by field produces multiple data series. Each sourcetype is a data series with its own count values for each user.

A column chart

Generate a bar or column chart

  1. Select the Add chart button ( The Add Chart button in the editing toolbar. ) in the editing toolbar and browse through the available charts. Choose a bar or column chart.
  2. Select the chart on your dashboard to highlight it with the blue editing outline.
  3. Set up a new data source by selecting + Create search and adding a search to the SPL query window. Or, you can select an existing data source under the Search, Saved search, or Chain search sections.
  4. (Optional) You can also write a new ID that describes the search better than the default by changing the ID in Data source name.
  5. Select Apply and close.

Configuration Panel options for bar and column charts

You can use the Configuration panel to configure the following bar and column chart components.

Title

Give your visualization a name. This is also helpful when searching for individual visualizations in the dashboard definitions. This name is not the same as the automatically assigned unique ID.

Description

Give your visualization a description to explain what the user is viewing.

Data Sources

Choose an existing ad hoc search or create a new one.

Position & Size
You can use your mouse to change the size of the panel, or the Position & Size section of the Configuration panel for pixel perfect sizing and placement.

General

Use the following Stack Modes:

Stack option Column or bar appearance Use case
Unstacked Columns or bars for different series appear next to each other. An unstacked chart is useful for a lower number of series. As the number of series increases, the chart can become more difficult to understand.
Stacked Data points within a series appear as segments of a column or bar. The total column or bar value is the sum of all of the segments. Use a stacked column or bar chart to highlight the relative volume, frequency, or importance of data points in a series. See the stacked chart example below.
Stacked 100% Each bar or column is divided into segments representing the distribution percentage for each data value in one series. Use stacked 100% to show data distributions when there is significant segment size variation in each column or bar.

Show Data Values

Choose whether to show all data values (On), no data values (Off), or only the minimum and maximum (Min/Max).

Axis

  • Use X Axis title to name your x-axis.
  • Use Y Axis title to name your y-axis.

Legend

  • Use Position to choose the position of the legend.
  • Use Truncation to choose how legend labels are truncated when they overflow the layout boundaries by choosing where to place ellipses (...)

Drilldown
Drilldown from a bar or column chart to let users click on a part of the chart to open an internal or external URL.

Code
Select your visualization or its search to view and edit the source code in real-time. You can also change the Visualization ID to a more readable ID to help identify this visualization in the source code.

Source options for bar and column charts

You can customize your dashboard with the Dashboard Studio UI or set options in the source editor for splunk.bar and splunk.column. The UI and source options both produce the same design results.

Additionally, you can write advanced configurations in the source editor using selector and formatting functions and dynamic options syntax. For more details, see Modify and write dynamic options syntax.

Add source options to the options field of the visualization stanza. The following example shows the addition of background color settings using a hexadecimal code.

"viz_25NNIqLF": {
  "type": "splunk.bar",
  "options": {
    "backgroundColor": "#0000FF",
  },
  "dataSources": {
    "primary": "ds_gcEN4c7Q"
  }
} 


To read more on how visualization stanzas are structured, see The source code stanza of a visualization. Below are all of the options available.

Expand

Bar chart options

The following options are available for editing bar charts in the source editor:


Expand

Column chart options

The following options are available for editing column charts in the source editor:

Last modified on 01 May, 2024
Area and line charts   Bubble charts

This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters