Bubble chart
Use a bubble chart to visualize multiple series data in three dimensions. Bubble position represents two dimensions of the data series. Bubble size represents the third dimension.
Data formatting
To create a bubble chart, start with a search that generates multiple data series. Use this syntax to generate the series.
... | <stats_command> <y-axis_field> <x-axis_field> <bubble_size_field>
A single group-by field in the query generates a visualization with all bubbles in the same color. To get series colors with the stats
command, use two group-by fields. This generates a bubble for each unique combination of those two fields. The value of the second field determines the series color.
Configuration options
Bubble chart configurations include the following options. Use the Format menu to adjust these settings.
- Minimum and maximum bubble marker size
- Axis titles
- X-axis label rotation and truncation
- Axis scale, interval, minimum and maximum values
- Abbreviate y-axis and x-axis numerical values
Create a bubble chart
Prerequisites
Review the following details about building column and bar charts.
Steps
- Write a search that generates three data series.
- Run the search.
- Select the Statistics tab below the search bar. The statistics table here should have four columns.
- Select the Visualization tab and use the Visualization Picker to select the bubble chart visualization.
- (Optional) Use the Format menu to configure the visualization.
Example
This search aggregates earthquake events by location. It generates data series representing the magnitude, depth, and count for each earthquake location.
source="earthquakes.csv" | stats count by place, mag, depth
The search generates a bubble chart where the x-axis and y-axis plot magnitude and depth. The bubble size indicates the relative count value for a particular location.
Scatter chart | Event annotations for charts |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.3.2408, 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2205, 9.0.2208, 8.2.2203, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)
Feedback submitted, thanks!