Design pivot charts and visualizations with the Pivot Editor

To define a data visualization with the Pivot Editor, select the visualization type from the black sidebar that runs down the left-hand side of the Editor. The charts and data visualizations are listed in the following order:

• Table
• Column chart
• Bar chart
• Scatter chart
• Area chart
• Line chart
• Pie chart
• Single value visualization
• Radial gauge
• Marker gauge
• Filler gauge

Before building pivot charts and visualizations it's helpful (but not necessary) to have an understanding of how pivot tables work. We suggest that you begin building your pivot as a table and then switch over to the visualization of your choice. For more information, read "Design pivot tables with the Pivot Editor," especially the subsection titled "Understanding pivot table elements." The table in this section explains how pivot elements are used by pivot charts and visualizations.

Important: You should read "Data structure requirements for visualizations" to get some additional background on how Splunk software utilizes tabular data for charts and data visualizations.

On switching between Pivot visualization types

When you switch between pivot visualizations Pivot will find the pivot elements it needs to create the visualization, discard the elements it doesn't need, and notify you when needed elements need to be defined. This applies when you're switching between tables and charts as well as between chart types.

For example: If you switch your Pivot from table mode to column chart mode but haven't defined a split row element while in table mode, the Y-Axis control panel for the column chart will be yellow and will be marked "Required". Pivot won't attempt to create the column chart until you choose a field for the chart's x-axis.

If there are no available fields in the selected pivot dataset for a chart or single data visualization control panel segment, that panel segment won't be displayed. For example, if you're working with a data model dataset that does not have a _time field, the Time Range control panel will be unavailable when you switch from the pivot table view to the column chart visualization type.

When you select a visualization type that can only use a specific field to populate a required control panel, that control panel will be pre-populated when the visualization type is selected. For example, when you switch to a line or area chart from a column chart, the X-Axis control will be pre-populated with time even if you had a different field selected for the x-axis in the column chart view

When in the Pivot Editor you switch from one visualization type to another, the visualization you land on will display the elements that were used by the chart or visualization you came from, with the exception of those that it cannot use. If you return to the pivot table mode after looking at your data as a column chart and see the same table that you left, it's probably because the column chart was able to make use of all of the pivot elements as they were originally defined. If you don't want to lose your pivot visualization configuration when you switch to another visualization type, you can save it as a report first. (For more information about saving pivots as reports, see "Create and edit reports," in the Reporting Manual.)

Controls common to all charts and single value visualizations

The Time Range and Filter controls are common to all of the chart types and single value visualizations (including gauges) offered by the Pivot Editor.

Time Range

The Time Range control panel operates exactly like the time range menu that is in use throughout Splunk Web. It corresponds to the time range filter element in pivot tables. For more information about the time range menu, see "Select time ranges to apply to your search" in the Search Manual.

Filter

In the Filter control panel, you can set up multiple filters on different dataset fields, to narrow down the dataset reported on by the chart or visualization. The filter controls operate exactly the same as they do for filter elements in a pivot table.

For more information and a full description of the available configuration options see "Configure a filter element," in "Design pivot tables with the Pivot Editor," in this manual.

Column and bar chart controls

Column charts and bar charts use nearly the same controls. There are only two differences:

• For bar charts, the x-axis is the vertical axis while the y-axis is the horizontal axis. In other words, the x-axis and y-axis are reversed from the way they're set up for column charts.
• Column charts enable rotation of column labels. Choose the way you want your column labels to display with Label Rotation.

Column and bar charts require the definition of x-axis and y-axis elements. Splunk software can't render the charts without them.

Important: Column charts built in the Pivot Editor have zoom and pan functionality. With your mouse you can select a section of the chart to "zoom" in on it. Once zoomed in, you can use left and right arrows to pan along the x-axis. Click Reset zoom to return to the original chart. For more information, see "Chart controls" in the Dashboards and Visualizations manual.

X-Axis

To render a column or bar chart, X-Axis must be defined with a field. The X-Axis control panel corresponds to the split row pivot element type, and shares its configuration options.

For more information and a full description of the available field configuration options see "Configure a split row or split column element," in "Design pivot tables with the Pivot Editor," in this manual.

The X-Axis control panel also includes these chart-specific controls:

Label lets you provide an alternate label for the x-axis, or hide the x-axis label altogether.

Label Rotation lets you determine how x-axis column labels display along the x-axis.

Truncation is only available when x-axis column labels have a Label Rotation value that is not 0°. Set it to Yes to truncate overlong labels.

Note: Keep in mind that for bar charts, the X-Axis and Y-Axis swap places.

Y-Axis

To render a column chart, Y-Axis must be defined with a field that uses an aggregation operation (count, distinct count, average, sum, etc.) to output a number. The Y-Axis control panel corresponds to the column value pivot element type, and shares its configuration options.

Note: Selecting distinct count for a field with high cardinality (such as Name or Phone_Number) can slow pivot performance.

For more information and a full description of the available field configuration options see "Configure a column value element," in "Design pivot tables with the Pivot Editor," in this manual.

The Y-Axis control panel also includes these chart-specific controls:

Scale toggles the axis scale between linear and logarithmic. Logarithmic scale can be useful for charts where there is a wide range separating the y-axis values in the chart (where some values are extremely high while others are extremely low). .

Interval lets you enter a numerical value to control the tick interval on the y-axis.

Min Value and Max Value is where you can enter numerical values to focus the y-axis range. For example, if all of your column chart's y-axis values are above 100 and below 150, you might want to constrain the range to those min and max values; it can make the differences between the columns.

The Y-Axis control panel also includes a Label field that enables you to provide an alternate label for the y-axis, or hide the y-axis label altogether.

Note: Keep in mind that for bar charts, the X-Axis and Y-Axis swap places.

Color

You can optionally use the Color control panel to break your chart results out into series. Series are sets of colored columns or bars that represent different values of a field. For example, you could set up a column chart that shows webstore purchase attempts (a count, on the y-axis) over the past week (_time, on the x-axis), broken out by successful and failed attempts. In this case, the two attempt types--"successful" and "failed"--would be the "color." If the x-axis is broken out by day, you'll see two columns per day--blue columns for purchase successes, and yellow columns for purchase failures (your colors may vary).

The Color control panel corresponds to the split column pivot element type, and shares its configuration options. For more information and a full description of the available configuration options see "Configure a split row or split column element," in "Design pivot tables with the Pivot Editor," in this manual.

The Color control panel also includes these color/series-specific controls:

Position controls the position of the legend.

Truncation controls how legend labels should be truncated when they are too long.

Stack Mode lets you stack colors. You can choose Stacked and Stacked 100%. Stacking colors enhances chart readability when several colors (series) are involved, because they make it easy to quickly asses the relative weight (importance) of the different types of data that make up a specific dataset.

The Stacked 100% option lets you compare data distributions within a column or bar by making it fit to 100% of the length or width of the chart and then presenting its segments in terms of their proportion of that total "100%". Stacked 100% can help you to better see data distributions between segments in a column or bar chart that contains a mix of very small and very large stacks when Stack Mode is just set to Stacked.

General

In the General control panel you can enable or disable chart drilldown functionality. For more information about drilldown, see:

• Manage the pivot table display and format in Design pivot tables with the Pivot Editor.
• Use drilldown for dashboard interactivity in Dashboards and Visualizations.

Area and line chart controls

Area charts and line charts use most of the same controls as column and bar charts. The primary difference is that in Pivot, line and area charts can only have _time as their x-axis field. If _time is unavailable for the x-axis, the line and area chart types are unavailable.

Like column and row charts, Pivot cannot render area and line charts until you define a y-axis field for them.

For area and line charts, the Color and General control panels are configured the same way that they are for column and bar charts (see above). For the Time Range and Filter control panels, see "Controls common to all charts and single value visualizations", above.

Important: Area and line charts built in the Pivot Editor have zoom and pan functionality. With your mouse you can select a section of the chart to "zoom" in on it. Once zoomed in, you can use left and right arrows to pan along the x-axis. Click Reset zoom to return to the original chart. For more information, see "Chart controls" in the Dashboards and Visualizations manual.

X-Axis

As mentioned above, for line and area charts, the X-Axis control panel only accepts the _time timestamp field, because line and area charts are always timecharts, showing change in a numeric value over time. The control panel is configured in the same way that split row pivot elements are, otherwise.

For more information and a full description of the available configuration options see "Configure a split row or split column element," in "Design pivot tables with the Pivot Editor," in this manual.

The X-Axis control panel also includes these controls these chart-specific controls:

Label lets you hide the x-axis label (you can't rename the _time field).

Label Rotation lets you determine how x-axis tick interval labels display along the x-axis.

Truncation is only available when x-axis tick interval labels have a Label Rotation value that is not 0°. Set it to Yes to truncate overlong labels.

Y-Axis

Line and area charts configure their y-axis information in the same way that column and bar charts do (see above). The only difference is that line and area charts get one extra y-axis control. Null Value Mode helps you determine how null values should be handled in the chart. You can omit them, treat them as zeros, or connect across them.

Scatter chart controls

While scatter charts have similarities in appearance to column, bar, line, and area charts, they are set up differently. They have four dimensions:

• A required "Mark" control that creates a "mark" on the scatter chart for each unique value of its field.
• Required numeric x- and y-axis ranges, which are used to plot the location of the scatter-plot marks.
• An optional Color control that ensures that all of the scatter chart marks that share a specific value with its field have the same color.

For scatter charts, the General control panel is configured the same way as column and bar charts. For details about the Time Range and Filter control panels, see "Controls common to all charts and single value visualizations", above.

Mark

Scatter charts require a field for the Mark control panel, which creates a "mark" on the scatter chart for each unique value of the supplied field. The Mark control panel corresponds to the split row pivot element type and shares its configuration options, with the exception that it does not allow you to override the field label.

In a pivot table the Mark field corresponds to the first split row element while the Color field corresponds to the second split row element, if one is defined. Splunk software will not allow you to define the same field for both Mark and Color; if you choose a field in one it will be unavailable when you define the other.

For more information and a full description of the available configuration options see "Configure a split row or split column element," in "Design pivot tables with the Pivot Editor," in this manual.

X-Axis and Y-Axis

Scatter charts require fields for the X-Axis and Y-Axis control panels, which Splunk software uses to plot the location of the scatter chart marks. Both controls correspond to the column value pivot element type and share its configuration options. In a pivot table, the scatter chart X-Axis controls use the first column value element, while the Y-Axis controls use the second column value element, if one is defined.

For more information and a full description of the available configuration options see "Configure a column value element," in "Design pivot tables with the Pivot Editor," in this manual.

The X-Axis and Y-Axis control panels include these chart-specific controls:

Scale toggles the axis scale between linear and logarithmic. Logarithmic scale can be useful for charts where there is a wide range separating the axis values in the chart (where some values are extremely high while others are extremely low).

Interval lets you enter numerical values to control the tick intervals on the axis.

Min Value and Max Value are where you can enter numerical values to focus the axis range. This can make the differences between a number of values that are close together easier to see. For example, if all of your scatter chart marks are located above 100 and below 110 on the y-axis, you might want to constrain the range to those min and max values to make the differences between their locations more apparent.

The X-Axis control panel has additional controls for x-axis labels:

Label Rotation lets you determine how x-axis tick interval labels display along the x-axis.

Truncation is only available when x-axis tick interval labels have a Label Rotation value that is not 0°. Set it to Yes to truncate overlong labels.

Color

For scatter charts, definition of a field for the Color panel is optional. The Color control panel corresponds to the split row pivot element type and shares its configuration options. It ensures that all of the scatter chart marks that share a specific value with its field have the same color.

The Color field corresponds to the second split row element in the pivot table definition, if one is defined. As such, it provides a second level of row splitting beyond the mandatory row split performed by the Mark field.

For more information and a full description of the available configuration options see "Configure a split row or split column element," in "Design pivot tables with the Pivot Editor," in this manual.

The Color controls for scatter charts additionally enable you to hide the field label or override it with a new label. It also includes fields that are specific to the chart legend: Position and Truncation.

Position controls the position of the legend.

Truncation controls how legend labels should be truncated when they are too long.

Pie chart controls

Pie charts are relatively simple as they make use of the first row split element and the first column value element in a pivot definition. The row split element determines the number of slices in the pie, their labels, and their colors. The column value element determines the size of each pie slice relative to the others. In the Pivot chart editing interface for the pie chart these elements translate to the Color and Size controls, respectively.

Pie charts also make use of the Time Range, Filter, and General controls. The General controls are configured the same as column and bar charts. For details about the Time Range and Filter control panels, see "Controls common to all charts and single value visualizations", above.

Color

All of the fields for the pie chart Color control panel correspond directly to the split row pivot element type. The Color controls determine the number of slices in the pie, their labels, and their colors.

For more information and a full description of the available configuration options see "Configure a split row or split column element," in "Design pivot tables with the Pivot Editor," in this manual.

Size

All of the fields for the pie chart Size control panel correspond directly to the column value pivot element type. The Size controls determine the size of each pie slice relative to the others.

For more information and a full description of the available configuration options see "Configure a column value element," in "Design pivot tables with the Pivot Editor," in this manual.

Single value visualization controls

Single value visualizations return just one number that optionally can be bracketed with label text. They make use of a single column value pivot element.

Use the Time Range and Filter controls to filter the results returned by the single column value pivot element, as appropriate. For more information about the settings for these panels, see "Controls common to all charts and single value visualizations", above.

Value

The Value controls make use of a single column value pivot element. The events it returns can be filtered by the time range and whatever filters you set up in the Filter control panel.

For more information and a full description of the available configuration options see "Configure a column value element," in "Design pivot tables with the Pivot Editor," in this manual. The only exception for single value visualizations is that you cannot specify an alternate label for the selected field.

For single value visualizations, the Value controls include three additional fields on top of those typical to the column value element type. They are all optional.

Before Label supplies the label text to display before the value.

After Label supplies the label text to display after the value.

Under Label supplies the label to display under the value.

Gauge visualization controls

The various gauge visualizations (radial, marker, and filler) use the value returned by a single-row table with just one column value pivot element to determine where the gauge indicator is at at any given moment. You can set the gauge ranges and colors (see the section on the Value control panel, below).

Use the Time Range and Filter controls to filter the results returned by the single column value pivot element, as appropriate. For more information about the settings for these panels, see "Controls common to all charts and single value visualizations", above.

Value

The Value controls make use of a single column value pivot element. The events it returns can be filtered by the time range and whatever filters you set up in the Filter control panel.

For more information and a full description of the available configuration options see "Configure a column value element," in "Design pivot tables with the Pivot Editor," in this manual. The only exception for single value visualizations is that you cannot specify an alternate label for the selected field.

For gauge visualizations the Value controls also includes a Color Ranges fieldset that enables you to define the ranges and colors represented on the gauge. The default setting includes three ranges that cover the span from 1 to 100 and are colored green, yellow and red, respectively. You can change the numeric ranges, add ranges, and update the colors displayed for each range as appropriate for the values returned by the column value element that powers the visualization.

General

Style toggles the appearance of the gauge between a minimalist and "shiny" appearance.