Splunk® Light (Legacy)


Acrobat logo Download manual as PDF

On October 22, 2021, Splunk Light will reach its end of life. After this date, Splunk will no longer maintain or develop this product.
Acrobat logo Download topic as PDF

About data visualizations

Splunk Light provides a number of options for search result visualization. You can see event data presented as event listings, tables, and charts (such as column, line, area, and pie charts.) You can choose from a variety of gauge and single value displays for searches that return a single, discrete, numerical value. You can also plot geographic coordinates as interactive markers on a world map.

This topic discusses how you can access the visualization features and briefly describes the visualization options.

Accessing visualization features

Splunk Light provides tools to modify and create visualizations in the Search and Dashboard pages.

Visualizations from Search

You can modify how search results display in the Search page. The search must be a reporting search that returns results that can be formatted as a visualization.

After running a search, select the Visualization tab, then select the type of visualization to display. You can specify formatting options for the selected visualization.

Dashboard panel visualizations

When you base a new dashboard panel on search results you can choose the visualization that best represents the data returned by the search. You can then use the Visualization Editor to fine-tune the way the panel visualization displays.

To create a dashboard panel from search results, after you run the search click Save As > Dashboard Panel. You can also create the panel directly from the Dashboard page.

Visualization options and data structures

The following table lists the different types of visualizations you can choose with Splunk Light.

Visualization Type Description
Event visualizations Event visualizations are essentially raw lists of events.
Tables You can generate table visualizations from just about any search. Searches that include transform operations, such as stats, chart, and timechart, generate more interesting tables. You can also configure table visualizations to display sparklines.
Charts Chart visualizations include column, line, area, scatter, and pie charts. These visualizations require transforming searches whose reults involve one or more series. All chart visualizations can display single-series searches. However the bar, column, line, and pie chart visualizations usually display the data best. Pie charts can only display data from single series searches. If a search produces multiple series, bar, column, line, area, and scatter chart visualizations display the data best.
Single-value visualizations Single-value visualizations display the results of a transforming search that returns a single value. For example, a search that returns the total count of events for a specific set of search criteria.
Gauges Gauge visualizations map a single numerical value against a range of colors that may have a particular business meaning or logic. Gauges use range maps to define color ranges. You can choose from three types of gauge visualizations: radial, filler, and marker.
Maps The map visualization lets you plot geographic coordinates as interactive markers on a world map. Searches for map visualizations typically use the geostats search command to plot markers on a map.

The visualization you can choose depends on the data structure your search returns. If you find the visualization you want is unavailable when you try to create a new panel, then perhaps your underlying search does not return the data that works for that visualization.

For example, most chart visualizations require search results that are structured as tables with at least two columns. The first column provides x-axis values. The subsequent columns provide y-axis values for each series represented in the chart.

For more information, see Data visualization library in the References manual.

Last modified on 11 October, 2016
Search commands by category
Data visualization library

This documentation applies to the following versions of Splunk® Light (Legacy): 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters