Splunk Cloud Platform

Dashboards and Visualizations with Simple XML

Bubble chart

Use a bubble chart to visualize multiple series data in three dimensions. Bubble position represents two dimensions of the data series. Bubble size represents the third dimension.

Data formatting

To create a bubble chart, start with a search that generates multiple data series. Use this syntax to generate the series.

... | <stats_command> <y-axis_field> <x-axis_field> <bubble_size_field>

A single group-by field in the query generates a visualization with all bubbles in the same color. To get series colors with the stats command, use two group-by fields. This generates a bubble for each unique combination of those two fields. The value of the second field determines the series color.

Configuration options

Bubble chart configurations include the following options. Use the Format menu to adjust these settings.

  • Minimum and maximum bubble marker size
  • Axis titles
  • X-axis label rotation and truncation
  • Axis scale, interval, minimum and maximum values
  • Abbreviate y-axis and x-axis numerical values

Create a bubble chart

Review the following details about building column and bar charts.


  1. Write a search that generates three data series.
  2. Run the search.
  3. Select the Statistics tab below the search bar. The statistics table here should have four columns.
  4. Select the Visualization tab and use the Visualization Picker to select the bubble chart visualization.
  5. (Optional) Use the Format menu to configure the visualization.


This search aggregates earthquake events by location. It generates data series representing the magnitude, depth, and count for each earthquake location.

source="earthquakes.csv" | stats count by place, mag, depth

The search generates a bubble chart where the x-axis and y-axis plot magnitude and depth. The bubble size indicates the relative count value for a particular location.

7.1 bubble chart.png

Last modified on 02 June, 2023
Scatter chart   Event annotations for charts

This documentation applies to the following versions of Splunk Cloud Platform: 9.2.2403, 8.2.2201, 8.2.2202, 8.2.2112, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308 (latest FedRAMP release), 9.1.2312

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters