Create charts in Splunk Observability Cloud 🔗
Splunk Observability Cloud provides a number of built-in dashboards for services you integrate with Observability Cloud. These dashboards have charts that track key metrics for integrated services. In many cases, you don’t have to create any additional charts or dashboards. However, if you do need a chart that isn’t included in a built-in dashboard, this section explains how to create one.
Before you create a chart, you need to have an idea of which metrics you want to track. Metrics are added as signals on plot lines, or plots, on a chart. If you are unfamiliar with the metrics available, see View dashboards in Splunk Observability Cloud to see which metrics are tracked in your organization’s dashboards.
Also consider ways in which you might want to customize some default settings. For example, you might want to filter the metrics to include data for specific hosts, or specify a different default time range for the chart. Keep these requirements in mind as you plan your chart.
Instead of displaying metrics on a chart, you can also:
create a chart that contains a text note. See Add a text note to a dashboard.
create a chart that contains an event feed. See Add an event feed chart to a dashboard.
overlay events on a chart that already displays some metrics. See View events on a chart.
link a detector to a chart and display its alert status on the chart. See Link detectors to charts.
Create a chart 🔗
Once you have an initial plan for the metrics you want to display on your chart, there are various ways to create a chart, depending on your starting point.
You can’t add charts to a built-in dashboard; for more information, see Modify built-in dashboards and their charts.
To create one or more simple charts on a new or existing dashboard, see Create simple charts using Splunk Observability Cloud. This technique is also a good choice if you want to see what metrics are available, because you can see them in the Metrics Sidebar.
To copy charts you see on a dashboard to a new or existing dashboard, see Copy charts.
To copy charts you are viewing in the Chart Builder, use the Save As option (see Save a chart), change the name as desired, and choose the dashboard where you want to place the copied chart. If you have edited the chart, those changes will be reflected in the copied chart.
To create a chart based on a metric you have found in the Metadata Catalog, see Create a chart from the Metadata Catalog.
To build a chart from scratch, see Create a new chart using the Chart Builder.
To programmatically create a chart instead of creating one through the user interface, see Create a chart using Splunk Observability Cloud API.
Copy charts 🔗
You can copy charts from one or multiple dashboards to a clipboard. This technique is useful if you are troubleshooting an issue and want to pull some existing charts together to view on a new dashboard (see Create a dashboard), or if you want to copy charts from one dashboard to another.
You can also use this method to “move” a chart from one dashboard to another; after copying a chart, simply delete the original chart.
Follow these steps to copy charts to a clipboard:
To start, open the dashboard containing the chart you want to copy. Staying in the dashboard view, select Copy from the Chart actions drop-down menu of the chart you want to copy. You have to be in dashboard view to see the Copy option.
When you copy a chart, a counter on the Create icon on the navigation bar indicates how many charts you have copied to the clipboard.
To copy another chart to the clipboard, select Chart actions > Add to Clipboard from a different chart, or click the Add to clipboard icon on another chart while in the dashboard view. The counter increments as you add additional charts.
Different options on the Create menu let you paste the charts onto a dashboard. Pasting charts clears the clipboard.
To paste the charts into a dashboard you are viewing, select Paste Charts from the Create menu. You must have write permissions for the dashboard. See Write permissions for more detail.
If you see Dashboard with <n> copied charts on the Create menu, select that option to create a new, unsaved dashboard and paste the charts into it.
If you see Dashboard (unsaved) on the Create menu, you have already added charts to a new dashboard and haven’t saved the dashboard yet. Click this option to open the unsaved dashboard, then select Paste Charts.
To clear the clipboard contents without pasting the charts to a dashboard, select Clear Clipboard from the Create menu.
Create a new chart using the Chart Builder 🔗
Select Chart from the Create menu. Alternatively, you can click New Chart on custom dashboards.
See also Choose a chart type.
Create a chart from the Metric Finder 🔗
Use the Metric Finder to find the metric you want to track. From the results page, click on the metric name to open the Chart Builder, prepopulated with your metric.
See also Choose a chart type.
Create a chart from the Metadata Catalog 🔗
You can also create a chart from the Metadata Catalog. Select a metric from the list in the sidebar, then click View in Chart in the preview pane to open the Chart Builder, prepopulated with your metric.
See also Choose a chart type.
Choose a chart type 🔗
Available chart types are shown as icons in the chart’s title bar. You can also choose a chart type in the Chart Options tab. Hover over an icon to see which chart type it represents, then click an icon to display the chart in that format. The selected chart type is highlighted and indicated by a small pointer.
To learn more about different chart types, see Chart types in Splunk Observability Cloud.
See the following sections for more information on when to use each type of chart:
In some cases, you might want to create multiple charts for the same data displayed in different ways. One way to do that is to copy a chart then change the chart type after you paste it from the clipboard. Another way is to change the chart type and then use Save as to save it as a new chart, preferably with a new name. See Copy charts for more information.
Use graph charts 🔗
Use graph charts when you want to display data points over a period of time. To learn more about graph charts, see Graph charts.
The first four icons in the chart’s title bar represent the four visualization options for graph charts:
Line: To learn more about line visualization, see Line charts.
Area: To learn more about area visualization, see Area charts.
Column: To learn more about column visualization, see Column charts.
Histogram: To learn more about histogram visualization, see Histogram charts.
The chart type you choose here is applied as a default to all the plots on the chart, but you can choose a different visualization type for individual plots. See Set options in the plot configuration panel.
To customize a chart, see Chart Options in the Chart Builder.
Use single value charts 🔗
Choose this chart type when you want to see a single number in a large font that represents the current value of a single data point on a plot line. If the time period is in the past, the number represents the value of the metric near the end of the time period.
To learn more about single value charts, see Single value charts.
To display an accurate value, the plot must use an aggregate analytics function that generates a single value for each data point on the chart, such as Mean, Sum, Max, etc. If the plot line always reflects only a single time series, no analytics function is needed. However, this is uncommon.
If the plot line on the chart shows multiple values, i.e. one line per MTS when viewed as a line chart, the single number displayed on the chart might represent any of the values for a given point in time.
If multiple plots are marked as visible, the value represents the first visible plot in the list. For example, if plots A and B are visible, the value represents plot A. If you hide plot A, the value represents plot B.
To customize a chart, see Chart Options in the Chart Builder. An especially useful option for this chart type is Color by value, which lets you use different colors to represent different value ranges.
Use heatmap charts 🔗
Use heatmap charts when you want to see the specified plot in a format similar to the navigator view in Infrastructure Monitoring, with squares representing each source for the selected metric, and the color of each square representing the value range of the metric.
To learn more about heatmap charts, see Heatmap charts.
To customize a chart, see Chart Options in the Chart Builder.
Use list charts 🔗
Use this chart type to display current data values in a list format. By default, the name of each value in the chart reflects the name of the plot and any associated analytics. To avoid having the raw metric name displayed on the chart, give the plot a meaningful name.
To learn more about list charts, see List charts.
To customize the information shown in the list, see Chart Options in the Chart Builder.
Use event feed charts 🔗
Use this chart type when you want to see a list of events on your dashbboard.
To learn more about event feed charts, see Event feed charts.
To customize the information shown in the feed, see Add an event feed chart to a dashboard.
Use text charts 🔗
Use text charts when you want to place a text note on the dashboard instead of displaying metrics.
To learn more about text charts, see Text charts.
See also Add a text note to a dashboard.
Use table charts 🔗
A table chart displays metrics and dimensions in table format. Each metric name and dimension key displays as a column. Each output metric time series displays as a row. If there are multiple values for a cell, each time series displays in a separate row.
You can group metric time series rows by a dimension. To do this, click the Group by menu and select the dimension you want to group the rows by. The selected dimension’s column becomes the first column and each row of the table displays to represent one value of the dimension.
For example, group the table by the
host dimension to display the health and status of each host in your environment.
If you choose to group by a dimension column that you’ve hidden, the column displays to accomplish the requested grouping.
After using the Group by option to group the table, there may still be more than one row per dimension value. This can happen if there are multiple values for a column per grouping dimension value. To resolve this, you can apply aggregation analytics to plots.
For more information about aggregation, see Aggregate and transform data.
If there are missing data values for a table cell, the cell displays no value.
Here are some additional ways in which you can customize a table chart to best visualize your data:
Reorder a dimension column
Click and drag the column header to move the column to its new position. You can’t reorder metric columns.
Show or hide a column
Click the gear icon near the upper right of the table. In the SHOW/HIDE COLUMNS section, click the column name to toggle between showing and hiding the column.
Sort table values
Click a column header to toggle between sorting by ascending and descending order. An arrow icon displays in the column header to indicate the sort order.
Link a detector to the table chart
Click the Alerts icon (bell) near the upper right of the Chart Builder. Select Link detector to link the table chart to an existing detector. Select New Detector From Chart to create a new detector to link the table chart to.
For more information about creating a new detector from a chart, see Create a detector from a chart.
A chart that is linked to a detector displays with a border color that corresponds to the alert status of the linked detector. For example, if there are no alerts issued by the detector, the chart displays with a green border. The chart displays alerts in the chart header, but doesn’t display alert status per row.
For more information about customizing charts, see Chart Options in the Chart Builder.
Edit a chart 🔗
To edit a chart, open it from any dashboard or the Dashboard panel of a navigator. Editing a chart is essentially identical to building a chart. See Plot metrics and events using Chart Builder in Splunk Observability Cloud.
If you don’t have write permissions for the dashboard containing the chart, or you are in a built-in dashboard, you have to use Save as to save the edited chart.
Save a chart 🔗
When you finish creating or editing a chart, click Save, Save as, or Save and close from the Chart actions drop-down menu of the chart. The button text varies depending on how you created or opened the chart. If the button is not labeled with the option you want, you can select other options from the Chart actions menu.
If you don’t have write permissions for the dashboard you are viewing, or you are in a built-in dashboard, you can’t see an option to save the chart. Instead, you have to use Save as to save the chart.
If you don’t want to save your changes, click Close.
If you click Close, you will not be prompted to save the chart, even if you have made some changes. Any unsaved changes will be lost.