topic How to read a fourth value from scatter plot? in Dashboards & Visualizations

How to read a fourth value from scatter plot?

Oti47 — Sat, 18 Nov 2023 01:04:45 GMT

Hello,
I have a problem,
how do I get a fourth value from a table and scatterplot to use the value in a token?

We have a table with 4 columns and a scatterplot chart for display.

article, value, calculate category and PartnerId

Unfortunately, the PartnerId is not displayed in the scatterplot chart.
Can I somehow read out the fourth value to display further details on a PartnerID in a dashboard?

Re: How to read a fourth value from scatter plot?

richgalloway — Sat, 18 Nov 2023 01:09:21 GMT

Scatter plots are two-dimensional so they take 3 arguments: value, x-axis, and y-axis. A fourth argument would call for a three-dimensional chart and that calls for an add-on like https://splunkbase.splunk.com/app/3138. See https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/ScatterChart

Re: How to read a fourth value from scatter plot?

Oti47 — Sat, 18 Nov 2023 10:43:16 GMT

Hello,
two dimensions are enough.
I only need the PartnerID as a value at the measuring point to branch from the display to another detail dashboard.

Are there any ideas?

Regards

Michael

Re: How to read a fourth value from scatter plot?

richgalloway — Sat, 18 Nov 2023 13:01:14 GMT

For a 2-D plot, you'll have to somehow reduce the number of arguments to 3. Perhaps you can concatenate two of the values (| eval foo=bar . baz) and graph the remaining three.

Re: How to read a fourth value from scatter plot?

tscroggins — Sun, 19 Nov 2023 17:13:48 GMT

Hi @Oti47,

Edit: This answer applies to Simple XML dashboards. Dashboard Studio may be limited to a single category field, as @richgalloway noted.

Edit 2: Snap. The Dashboard Studio scatter visualization is limited to x, y, and category fields in that order.

The search fragment for the scatter chart visualization provides a hint:

| stats x_value_aggregation y_value_aggregation by name_category [comparison_category]

If you're using a report, output from the inputlookup or table command, etc., make sure the fields are in name_category, comparison_category, x_value_aggregation, y_value-aggregation order by applying the stats command:

| stats values(category) as category values(value) as value by PartnerId article

where PartnerId and article are categorical values and category and value are numerical values. You can re-order the aggregation fields, category and value, and the split-by fields, PartnerId and article, as needed for your intended display:

| stats values(value) as value values(category ) as category by article PartnerId

Reformatting the output with the stats command adds the user interface field metadata (groupby_rank) used by the visualization to identify the name_category ("groupby_rank": 0) and comparison_category ("groupby_rank": 1) fields.

As a rule of thumb, the commands referenced in a visualization's search fragment will produce the desired result. Visualizations that reference chart, stats, timechart, xyseries, etc. most likely use internal metadata to format their output.

You can then use drilldown tokens associated with the data. See <https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Predefined_drilldown_tokens>. $click.value$ should represent the scatter chart name_category value, and $click.value2$ should represent the scatter chart comparison_category value.