About data visualizations
Splunk Light provides a number of options for search result visualization. You can see event data presented as event listings, tables, and charts (such as column, line, area, and pie charts.) You can choose from a variety of gauge and single value displays for searches that return a single, discrete, numerical value. You can also plot geographic coordinates as interactive markers on a world map.
This topic discusses how you can access the visualization features and briefly describes the visualization options.
Accessing visualization features
Splunk Light provides tools to modify and create visualizations in the Search and Dashboard pages.
Visualizations from Search
You can modify how search results display in the Search page. The search must be a reporting search that returns results that can be formatted as a visualization.
After running a search, select the Visualization tab, then select the type of visualization to display. You can specify formatting options for the selected visualization.
Dashboard panel visualizations
When you base a new dashboard panel on search results you can choose the visualization that best represents the data returned by the search. You can then use the Visualization Editor to fine-tune the way the panel visualization displays.
To create a dashboard panel from search results, after you run the search click Save As > Dashboard Panel. You can also create the panel directly from the Dashboard page.
Visualization options and data structures
The following table lists the different types of visualizations you can choose with Splunk Light.
|Event visualizations||Event visualizations are essentially raw lists of events.|
|Tables||You can generate table visualizations from just about any search. Searches that include transform operations, such as |
|Charts||Chart visualizations include column, line, area, scatter, and pie charts. These visualizations require transforming searches whose reults involve one or more series. All chart visualizations can display single-series searches. However the bar, column, line, and pie chart visualizations usually display the data best. Pie charts can only display data from single series searches. If a search produces multiple series, bar, column, line, area, and scatter chart visualizations display the data best.|
|Single-value visualizations||Single-value visualizations display the results of a transforming search that returns a single value. For example, a search that returns the total count of events for a specific set of search criteria.|
|Gauges||Gauge visualizations map a single numerical value against a range of colors that may have a particular business meaning or logic. Gauges use range maps to define color ranges. You can choose from three types of gauge visualizations: radial, filler, and marker.|
|Maps||The map visualization lets you plot geographic coordinates as interactive markers on a world map. Searches for map visualizations typically use the geostats search command to plot markers on a map.|
The visualization you can choose depends on the data structure your search returns. If you find the visualization you want is unavailable when you try to create a new panel, then perhaps your underlying search does not return the data that works for that visualization.
For example, most chart visualizations require search results that are structured as tables with at least two columns. The first column provides x-axis values. The subsequent columns provide y-axis values for each series represented in the chart.
For more information, see Data visualization library in the References manual.
Search commands by category
Data visualization library
This documentation applies to the following versions of Splunk® Light (Legacy): 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6