Format table visualizations
Use the Format menu to configure a table visualization.
Add summary statistics
Use the Format menu Summary tab to include column totals and percentages. For each statistic, a highlighted summary row appears at the bottom of the table. Column totals and/or percentages appear at the bottom of each column that contains numeric values.
Note: Values in a summary row reflect statistics for the complete search result set. For tables with more than one page of results, summary row values do not apply only to the currently displayed page.
Summary and data row differences
There are some behavior and formatting differences between summary rows and data rows in a table.
|Behavior or format
|Static highlight color
|Values in the row can skew table color formatting or data overlay
|Column number formatting applied to the row
|Drilldown available for the row
|Included in PDF or CSV export
Totals data row behavior
A static summary row fits most use cases. If you generate a totals data row using the
addcoltotals SPL command in a search, note the following table behavior impacts.
addcoltotalsrow is treated as a data row in the table.
- Because they are handled as data rows,
addcoltotalsrows are included in a PDF or CSV dashboard export.
- Color scales or data overlay can be skewed if a table includes an
- Tables should not include an
addcoltotalsdata row and a column totals summary row. If you opt to include a totals summary row, adjust the search to remove the
Summary row examples
The following examples show use case scenarios for adding column totals and percentage rows to a table.
Totals summary row
An analyst for an online retailer is evaluating how customer actions, such as purchases or quantity changes, relate to product types. The analyst is also comparing the relative frequency of different customer actions.
The following query generates a table showing product type counts for each customer action.
... | chart count(itemId) over categoryId by action
Using the Format menu, the analyst adds a totals summary row to the table.
The totals row shows relative totals for each customer action. For instance, there were 2634 purchase events in the results set, compared to 276 product removal events.
Percentage summary row
An analyst creates a table showing purchasing activity on a retail website. The following query generates results comparing purchases for different product types.
... | chart count(itemId) over action by categoryId
The analyst uses the Format menu to include a percentage row in the table.
This row shows a percentage for each product type relative to all purchases. For example, arcade games make up 9.5 percent of all purchases.
Format table columns
You can format individual table columns to add context or focus to the visualization. Click on the paintbrush icon at the top of each column to customize color and number formatting.
Note: Column formatting is not available for columns representing the
_time field or for sparkline columns.
Select and configure one of the following color modes for the column.
Note: Column color formatting overrides existing heat map or high/low value data overlay settings.
Use a sequential or divergent color scale on column cells. You can choose a preset scale or a custom configuration to manage how colors in the scale are applied to column cells.
Depending on search results and data distribution, column color gradation can vary. Columns with relatively similar values will show the most color gradation. Outlying values can limit the gradation.
Color scale options
Configure a custom color scale
You can configure custom color handling by indicating minimum, midpoint, and maximum value colors. Use one of the following options to configure the minimum, midpoint, and maximum value interpretation for the color scale.
|Use case example
|Highest and lowest values
|This option highlights the highest and lowest values in the column.
|Indicate numeric value thresholds. Cell color is determined according to how values align with the three thresholds.
|Determine cell color using percentages of the results value range.
|Determine cell color using percentiles of the results value distribution.
Apply color to cells in this column according to value ranges.
Use ranges to compare cell values categorically. For example, use red, yellow and green range colors to indicate low, medium, and high sales results.
Range configuration options:
- Adjust the default range value and color settings.
- Add or remove ranges.
Apply colors according to cell values.
Use automatic value coloring or define custom rules. Automatic coloring applies a color to every cell in the column. Cells with the same value appear in the same color.
Custom rules can help highlight specific values that you are monitoring. For example, use custom rules to highlight three new products in recent sales data.
Enable and adjust number formatting for each column. The number format settings panel includes the following options.
- Enable or disable number formatting.
- Set decimal precision.
- Opt to use thousand separators.
- Specify a measurement unit to add context to the values in this column. You can position the unit before or after each value.
Configure table properties
After generating a table, use the Format menu to configure one or more of the following table components.
- The number of rows shown in each table page
- Table row number display
The Format menu also includes the following data overlay options.
Add different shades of a particular color to the table to show value variation over table rows.
High and low value
Add high and low value colors to the table to highlight the highest and lowest values.
Use data overlay only if you are not adding column color formatting to the table. Column color formatting overrides data overlay configurations.
By default, drilldown is disabled when you save visualizations to a dashboard. You can use the drilldown editor or Simple XML to enable and configure drilldown options. For example, use drilldown to link to Splunk Answers posts relevant to the value users click in a table cell. See Use drilldown for dashboard interactivity for more details on enabling and configuring drilldown.
Simple XML drilldown options
In Simple XML, you can set the drilldown option to one of the following values. Use the
<drilldown> element to change the drilldown behavior.
|By default, opens a secondary search using the field and value in the selected cell.
|By default, opens a secondary search using the field and values from cells in the selected row.
Generate a table
Table column Simple XML
This documentation applies to the following versions of Splunk Cloud Platform™: 9.1.2312, 8.2.2202, 8.2.2112, 8.2.2201, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305 (latest FedRAMP release), 9.1.2308