Docs » Charts in Splunk Observability Cloud » Create charts in Splunk Observability Cloud

Create charts in Splunk Observability Cloud 🔗

Splunk Observability Cloud provides a number of built-in dashboards for services you integrate with Observability Cloud. These dashboards have charts that track key metrics for integrated services. In many cases, you don’t have to create any additional charts or dashboards. However, if you do need a chart that isn’t included in a built-in dashboard, this section explains how to create one.

Before you create a chart, you need to have an idea of which metrics you want to track. Metrics are added as signals on plot lines, or plots, on a chart. If you are unfamiliar with the metrics available, see View dashboards in Splunk Observability Cloud to see which metrics are tracked in your organization’s dashboards.

Also consider ways in which you might want to customize some default settings. For example, you might want to filter the metrics to include data for specific hosts, or specify a different default time range for the chart. Keep these requirements in mind as you plan your chart.

Note

Instead of displaying metrics on a chart, you can also:

Create a chart 🔗

Once you have an initial plan for the metrics you want to display on your chart, there are various ways to create a chart, depending on your starting point.

Note

You can’t add charts to a built-in dashboard; for more information, see Modify built-in dashboards and their charts.

Copy charts 🔗

You can copy charts from one or multiple dashboards to a clipboard. This technique is useful if you are troubleshooting an issue and want to pull some existing charts together to view on a new dashboard (see Create a dashboard), or if you want to copy charts from one dashboard to another.

You can also use this method to “move” a chart from one dashboard to another; after copying a chart, simply delete the original chart.

Follow these steps to copy charts to a clipboard:

  1. To start, open the dashboard containing the chart you want to copy. Staying in the dashboard view, select Copy from the Chart actions drop-down menu of the chart you want to copy. You have to be in dashboard view to see the Copy option.

  2. When you copy a chart, a counter on the Create icon on the navigation bar indicates how many charts you have copied to the clipboard.

  3. To copy another chart to the clipboard, select Chart actions > Add to Clipboard from a different chart, or click the Add to clipboard icon on another chart while in the dashboard view. The counter increments as you add additional charts.

Different options on the Create menu let you paste the charts onto a dashboard. Pasting charts clears the clipboard.

  • To paste the charts into a dashboard you are viewing, select Paste Charts from the Create menu. You must have write permissions for the dashboard. See Write permissions for more detail.

  • If you see Dashboard with <n> copied charts on the Create menu, select that option to create a new, unsaved dashboard and paste the charts into it.

  • If you see Dashboard (unsaved) on the Create menu, you have already added charts to a new dashboard and haven’t saved the dashboard yet. Click this option to open the unsaved dashboard, then select Paste Charts.

To clear the clipboard contents without pasting the charts to a dashboard, select Clear Clipboard from the Create menu.

Create a new chart using the Chart Builder 🔗

Select Chart from the Create menu. Alternatively, you can click New Chart on custom dashboards.

See also Choose a chart type.

Create a chart from the Metric Finder 🔗

Use the Metric Finder to find the metric you want to track. From the results page, click on the metric name to open the Chart Builder, prepopulated with your metric.

See also Choose a chart type.

Create a chart from the Metadata Catalog 🔗

You can also create a chart from the Metadata Catalog. Select a metric from the list in the sidebar, then click View in Chart in the preview pane to open the Chart Builder, prepopulated with your metric.

See also Choose a chart type.

Create a chart using Splunk Observability Cloud API 🔗

If you prefer to work programmatically, see Display Data Using Charts to create a chart with API.

Choose a chart type 🔗

Available chart types are shown as icons in the chart’s title bar. You can also choose a chart type in the Chart Options tab. Hover over an icon to see which chart type it represents, then click an icon to display the chart in that format. The selected chart type is highlighted and indicated by a small pointer.

To learn more about different chart types, see Chart types in Splunk Observability Cloud.

See the following sections for more information on when to use each type of chart:

Note

In some cases, you might want to create multiple charts for the same data displayed in different ways. One way to do that is to copy a chart then change the chart type after you paste it from the clipboard. Another way is to change the chart type and then use Save as to save it as a new chart, preferably with a new name. See Copy charts for more information.

Use graph charts 🔗

Use graph charts when you want to display data points over a period of time. To learn more about graph charts, see Graph charts.

The first four icons in the chart’s title bar represent the four visualization options for graph charts:

  • Line: To learn more about line visualization, see Line charts.

  • Area: To learn more about area visualization, see Area charts.

  • Column: To learn more about column visualization, see Column charts.

  • Histogram: To learn more about histogram visualization, see Histogram charts.

The chart type you choose here is applied as a default to all the plots on the chart, but you can choose a different visualization type for individual plots. See Set options in the plot configuration panel.

To customize a chart, see Chart Options in the Chart Builder.

Use single value charts 🔗

Choose this chart type when you want to see a single number in a large font that represents the current value of a single data point on a plot line. If the time period is in the past, the number represents the value of the metric near the end of the time period.

To learn more about single value charts, see Single value charts.

Important

To display an accurate value, the plot must use an aggregate analytics function that generates a single value for each data point on the chart, such as Mean, Sum, Max, etc. If the plot line always reflects only a single time series, no analytics function is needed. However, this is uncommon.

If the plot line on the chart shows multiple values, i.e. one line per MTS when viewed as a line chart, the single number displayed on the chart might represent any of the values for a given point in time.

Note

If multiple plots are marked as visible, the value represents the first visible plot in the list. For example, if plots A and B are visible, the value represents plot A. If you hide plot A, the value represents plot B.

To customize a chart, see Chart Options in the Chart Builder. An especially useful option for this chart type is Color by value, which lets you use different colors to represent different value ranges.

Use heatmap charts 🔗

Use heatmap charts when you want to see the specified plot in a format similar to the navigator view in Infrastructure Monitoring, with squares representing each source for the selected metric, and the color of each square representing the value range of the metric.

To learn more about heatmap charts, see Heatmap charts.

To customize a chart, see Chart Options in the Chart Builder.

Use list charts 🔗

Use this chart type to display current data values in a list format. By default, the name of each value in the chart reflects the name of the plot and any associated analytics. To avoid having the raw metric name displayed on the chart, give the plot a meaningful name.

To learn more about list charts, see List charts.

To customize the information shown in the list, see Chart Options in the Chart Builder.

Use event feed charts 🔗

Use this chart type when you want to see a list of events on your dashbboard.

To learn more about event feed charts, see Event feed charts.

To customize the information shown in the feed, see Add an event feed chart to a dashboard.

Use text charts 🔗

Use text charts when you want to place a text note on the dashboard instead of displaying metrics.

To learn more about text charts, see Text charts.

See also Add a text note to a dashboard.

Use table charts 🔗

A table chart displays metrics and dimensions in table format. Each metric name and dimension key displays as a column. Each output metric time series displays as a row. If there are multiple values for a cell, each time series displays in a separate row.

This screenshot shows a table chart grouped by the demo_host dimension, sorted by the demo_customer dimension, and linked to a detector with no alerts as illustrated by a green border around the table chart.

You can group metric time series rows by a dimension. To do this, click the Group by menu and select the dimension you want to group the rows by. The selected dimension’s column becomes the first column and each row of the table displays to represent one value of the dimension.

For example, group the table by the host dimension to display the health and status of each host in your environment.

If you choose to group by a dimension column that you’ve hidden, the column displays to accomplish the requested grouping.

After using the Group by option to group the table, there may still be more than one row per dimension value. This can happen if there are multiple values for a column per grouping dimension value. To resolve this, you can apply aggregation analytics to plots.

For more information about aggregation, see Aggregate and transform data.

If there are missing data values for a table cell, the cell displays no value.

Here are some additional ways in which you can customize a table chart to best visualize your data:

  • Reorder a dimension column

    Click and drag the column header to move the column to its new position. You can’t reorder metric columns.

  • Show or hide a column

    Click the gear icon near the upper right of the table. In the SHOW/HIDE COLUMNS section, click the column name to toggle between showing and hiding the column.

  • Sort table values

    Click a column header to toggle between sorting by ascending and descending order. An arrow icon displays in the column header to indicate the sort order.

  • Link a detector to the table chart

    Click the Alerts icon (bell) near the upper right of the Chart Builder. Select Link detector to link the table chart to an existing detector. Select New Detector From Chart to create a new detector to link the table chart to.

    For more information about creating a new detector from a chart, see Create a detector from a chart.

    A chart that is linked to a detector displays with a border color that corresponds to the alert status of the linked detector. For example, if there are no alerts issued by the detector, the chart displays with a green border. The chart displays alerts in the chart header, but doesn’t display alert status per row.

For more information about customizing charts, see Chart Options in the Chart Builder.

Edit a chart 🔗

To edit a chart, open it from any dashboard or the Dashboard panel of a navigator. Editing a chart is essentially identical to building a chart. See Plot metrics and events using Chart Builder in Splunk Observability Cloud.

If you don’t have write permissions for the dashboard containing the chart, or you are in a built-in dashboard, you have to use Save as to save the edited chart.

Save a chart 🔗

When you finish creating or editing a chart, click Save, Save as, or Save and close from the Chart actions drop-down menu of the chart. The button text varies depending on how you created or opened the chart. If the button is not labeled with the option you want, you can select other options from the Chart actions menu.

If you don’t have write permissions for the dashboard you are viewing, or you are in a built-in dashboard, you can’t see an option to save the chart. Instead, you have to use Save as to save the chart.

If you don’t want to save your changes, click Close.

Note

If you click Close, you will not be prompted to save the chart, even if you have made some changes. Any unsaved changes will be lost.