Docs » Charts in Splunk Observability Cloud » Create charts in Splunk Observability Cloud

Create charts in Splunk Observability Cloud đź”—

Splunk Observability Cloud provides a number of built-in dashboards for services you integrate with Splunk Observability Cloud. These dashboards have charts that track key metrics for integrated services. In many cases, you don’t have to create any additional charts or dashboards. However, if you do need a chart that isn’t included in a built-in dashboard, the following sections show you how to create a chart.

Before you create a chart, you need to have an idea of which metrics you want to track. Metrics appear on the chart as signals, which the documentation also refers to as plot lines or plots. If you are unfamiliar with the metrics available, see View dashboards in Splunk Observability Cloud to see the metrics that your organization receives for your dashboards.

Also consider customizing the defaults for your charts. You can filter metrics to limit the data to specific hosts, or specify a different time range for the chart. You can return to customize chart features at any time.

Note

Instead of displaying metrics on a chart, you can also:

Create a chart đź”—

Once you have an initial plan for the metrics you want to display on your chart, there are various ways to create a chart, depending on your starting point.

Note

You can’t add charts to a built-in dashboard. For more information, see Built-in dashboards.

Copy charts đź”—

You can copy charts from one or multiple dashboards to a clipboard. This technique is useful if you are troubleshooting an issue and want to pull some existing charts together to view on a new dashboard (see Create a dashboard), or if you want to copy charts from one dashboard to another.

You can also use this method to “move” a chart from one dashboard to another; after copying a chart, delete the original chart.

Follow these steps to copy charts to a clipboard:

  1. To start, open the dashboard containing the chart you want to copy. Staying in the dashboard view, select Copy from the Chart actions drop-down menu of the chart you want to copy. You have to be in dashboard view to see the Copy option.

  2. When you copy a chart, a counter on the Create icon on the navigation bar indicates how many charts you have copied to the clipboard.

  3. To copy another chart to the clipboard, select Chart actions > Add to Clipboard from a different chart, or select the Add to clipboard icon on another chart while in the dashboard view. The counter increments as you add additional charts.

Different options on the Create menu let you paste the charts onto a dashboard. Pasting charts clears the clipboard.

  • To paste the charts into a dashboard you are viewing, select Paste Charts from the Create menu. You must have write permissions for the dashboard. See Read and write permissions in Splunk Infrastructure Monitoring for more detail.

  • If you see Dashboard with <n> copied charts on the Create menu, select that option to create a new, unsaved dashboard and paste the charts into it.

  • If you see Dashboard (unsaved) on the Create menu, you have already added charts to a new dashboard and haven’t saved the dashboard yet. Select this option to open the unsaved dashboard, then select Paste Charts.

To clear the clipboard contents without pasting the charts to a dashboard, select Clear Clipboard from the Create menu.

Create a new chart using the Chart Builder đź”—

  1. Select Chart from the Create menu. Alternatively, you can select New Chart on custom dashboards.

  2. Search for metrics or events you want to plot on your chart. For more information, see Plot metrics and events using chart builder in Splunk Observability Cloud.

    Note

    You can add functions to your chart with the F(x) column. See Apply analytics to a plot and Functions reference for Splunk Observability Cloud for more details.

  3. Customize your chart. See Chart Options in the Chart Builder.

See also Select a chart type.

Create a chart from the Metric Finder đź”—

Use the Metric Finder to find the metric you want to track. From the results page, select the metric name to open the Chart Builder, pre-populated with your metric.

See also Select a chart type.

Create a chart from the Metadata Catalog đź”—

You can also create a chart from the Metadata Catalog. Select a metric from the list in the sidebar, then select View in Chart in the preview pane to open the Chart Builder, pre-populated with your metric.

See also Select a chart type.

Create a chart using Splunk Observability Cloud API đź”—

If you prefer to work programmatically, see Display Data Using Charts to create a chart with API.

Select a chart type đź”—

Available chart types are shown as icons in the chart’s title bar. You can also select a chart type in the Chart Options tab. Hover over an icon to see which chart type it represents, then select an icon to display the chart in that format. The selected chart type is highlighted and indicated by a small pointer.

To learn more about different chart types, see Chart types in Splunk Observability Cloud.

See the following sections for more information on when to use each type of chart:

Note

In some cases, you might want to create multiple charts for the same data displayed in different ways. One way to do that is to copy a chart then change the chart type after you paste it from the clipboard. Another way is to change the chart type and then use Save as to save it as a new chart, preferably with a new name. See Copy charts for more information.

Use graph charts đź”—

Use graph charts when you want to display data points over a period of time. To learn more about graph charts, see Graph charts.

The first four icons in the chart’s title bar represent the four visualization options for graph charts:

The chart type you choose here is applied as a default to all the plots on the chart, but you can choose a different visualization type for individual plots. See Set options in the plot configuration panel.

To customize a chart, see Chart Options in the Chart Builder.

Use single value charts đź”—

Choose this chart type when you want to see a single number in a large font that represents the current value of a single data point on a plot line. If the time period is in the past, the number represents the value of the metric near the end of the time period.

Caution

To display an accurate value, the plot must use an aggregate analytics function that generates a single value for each data point on the chart, such as Mean, Sum, Max, and so on. If the plot line always reflects only a single time series, no analytics function is needed. However, this is uncommon.

If the plot line on the chart shows multiple values, that is one line per metric time series (MTS) when viewed as a line chart, the single number displayed on the chart might represent any of the values for a given point in time.

Note

If multiple plots are marked as visible, the value represents the first visible plot in the list. For example, if plots A and B are visible, the value represents plot A. If you hide plot A, the value represents plot B.

To learn more about single value charts, see Single value charts.

To customize a chart, see Chart Options in the Chart Builder. An especially useful option for this chart type is Color by value, which lets you use different colors to represent different value ranges.

Use heatmap charts đź”—

Use heatmap charts when you want to see the specified plot in a format similar to the navigator view in Infrastructure Monitoring, with squares representing each source for the selected metric, and the color of each square representing the value range of the metric.

To learn more about heatmap charts, see Heatmap charts.

To customize a chart, see Chart Options in the Chart Builder.

Use list charts đź”—

Use this chart type to display current data values in a list format. By default, the name of each value in the chart reflects the name of the plot and any associated analytics. To avoid having the raw metric name displayed on the chart, give the plot a meaningful name.

To learn more about list charts, see List charts.

To customize the information shown in the list, see Chart Options in the Chart Builder.

Use event feed charts đź”—

Use this chart type when you want to see a list of events on your dashboard.

To learn more about event feed charts, see Event feed charts.

To customize the information shown in the feed, see Add an event feed chart to a dashboard.

Use text charts đź”—

Use text charts when you want to place a text note on the dashboard instead of displaying metrics.

To learn more about text charts, see Text charts.

See also Add a text note to a dashboard.

Use table charts đź”—

A table chart displays metrics and dimensions in table format. Each metric name and dimension key displays as a column. Each output metric time series displays as a row. If there are multiple values for a cell, each time series displays in a separate row.

This screenshot shows a table chart grouped by the demo_host dimension, sorted by the demo_customer dimension, and linked to a detector with no alerts as illustrated by a green border around the table chart.

You can group metric time series rows by a dimension. To do this, select the Group by menu and select the dimension you want to group the rows by. The selected dimension’s column becomes the first column and each row of the table displays to represent one value of the dimension.

For example, group the table by the host dimension to display the health and status of each host in your environment.

If you choose to group by a dimension column that you’ve hidden, the column displays to accomplish the requested grouping.

After using the Group by option to group the table, there might still be more than one row per dimension value. This can happen if there are multiple values for a column per grouping dimension value. To resolve this, you can apply aggregation analytics to plots.

For more information about aggregation, see Aggregate and transform data.

If there are missing data values for a table cell, the cell displays no value.

Here are some additional ways in which you can customize a table chart to best visualize your data:

  • Reorder a dimension column

    Select and drag the column header to move the column to its new position. You can’t reorder metric columns.

  • Show or hide a column

    • In graphical Plot Editor view, select the gear icon near the upper right of the table. In the SHOW/HIDE COLUMNS section, select the column name to switch between showing and hiding the column.

    • In SignalFlow Plot Editor view:

      • To hide a metric column, comment it out by adding a # to the start of the metric’s line of SignalFlow code. Alternatively, you can remove the metric.

      • To show or hide a dimension column, select the gear icon near the upper right of the table. In the SHOW/HIDE COLUMNS section, select the dimension column name to switch between showing and hiding the column.

  • Sort table values

    Select a column header to switch between sorting by ascending and descending order. An arrow icon displays in the column header to indicate the sort order.

  • Link a detector to the table chart

    Select the Alerts icon (bell) near the upper right of the Chart Builder. Select Link detector to link the table chart to an existing detector. Select New Detector From Chart to create a new detector to link the table chart to.

    For more information about creating a new detector from a chart, see Create a detector from a chart.

    A chart that is linked to a detector displays with a border color that corresponds to the alert status of the linked detector. For example, if there are no alerts issued by the detector, the chart displays with a green border. The chart displays alerts in the chart header, but doesn’t display alert status per row.

For more information about customizing charts, see Chart Options in the Chart Builder.

Edit a chart đź”—

To edit a chart, open it from any dashboard or the Dashboard panel of a navigator. Editing a chart is essentially identical to building a chart. See Plot metrics and events using chart builder in Splunk Observability Cloud.

If you don’t have write permissions for the dashboard containing the chart, or you are in a built-in dashboard, you have to use Save as to save the edited chart.

Save a chart đź”—

When you finish creating or editing a chart, select Save, Save as, or Save and close from the Chart actions drop-down menu of the chart. The button text varies depending on how you created or opened the chart. If the button is not labeled with the option you want, you can select other options from the Chart actions menu.

If you don’t have write permissions for the dashboard you are viewing, or you are in a built-in dashboard, you can’t see an option to save the chart. Instead, you have to use Save as to save the chart.

If you don’t want to save your changes, select Close.

Note

If you select Close, you will not be prompted to save the chart, even if you have made some changes. Any unsaved changes will be lost.

This page was last updated on Jun 14, 2024.