<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How could I show data using bubble chart? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694046#M56830</link>
    <description>&lt;P&gt;I tried to make "bubble chart", and information about this chart is this.&lt;/P&gt;&lt;P&gt;- &lt;STRONG&gt;x axis&lt;/STRONG&gt; : test start time&lt;/P&gt;&lt;P&gt;- &lt;STRONG&gt;y axis&lt;/STRONG&gt; : test duration time&lt;/P&gt;&lt;P&gt;- &lt;STRONG&gt;bubble size&lt;/STRONG&gt; : count depend on "x axis" &amp;amp; "y axis"&lt;/P&gt;&lt;P&gt;And this is my code.&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;              | eval start_time_bucket = case(
              start_time &amp;gt;= 0 AND start_time &amp;lt; 5, "0~5",
              start_time &amp;gt;= 5 AND start_time &amp;lt; 10, "5~10",
              start_time &amp;gt;= 10 AND start_time &amp;lt; 15, "10~15",
              start_time &amp;gt;= 15 AND start_time &amp;lt; 20, "15~20",
              true(), "20~")
              | eval duration_bucket=case(
              duration&amp;gt;=0 AND duration &amp;lt; 0.5, "0~0.5",
              duration&amp;gt;=0.5 AND duration &amp;lt; 1, "0.5 ~ 1",
              duration&amp;gt;=1 AND duration &amp;lt; 1.5, "1 ~ 1.5",
              duration&amp;gt;=1.5 AND duration &amp;lt; 2, "1.5 ~ 2",
              duration&amp;gt;=2 AND duration &amp;lt; 2.5, "2 ~ 2.5",
              true(), "2.5 ~"
              )
              | stats count by start_time_bucket, duration_bucket
              | eval bubble_size = count
              | table start_time_bucket, duration_bucket, bubble_size
              | rename start_time_bucket as "Test Start time" duration_bucket as "duration" bubble_size as "Count"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;So when the start_time is 12, and duration is 2, this data counted on bubble size at start_time_bucket = "10~15" and duration_bucket ="2~2.5".&lt;BR /&gt;I have a lot of data on each x &amp;amp; y axis, but It only show the bubble when the start_time_bucket = "0~5" and duration_bucket="0~0.5" like under the picture.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Questioner_0-1721732721677.png" style="width: 979px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/31856iDCB3AC051A6A6147/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Questioner_0-1721732721677.png" alt="Questioner_0-1721732721677.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;How could I solve this problem? when I show this data on table, it shows very well.&lt;/P&gt;</description>
    <pubDate>Tue, 23 Jul 2024 11:07:02 GMT</pubDate>
    <dc:creator>Questioner</dc:creator>
    <dc:date>2024-07-23T11:07:02Z</dc:date>
    <item>
      <title>How could I show data using bubble chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694046#M56830</link>
      <description>&lt;P&gt;I tried to make "bubble chart", and information about this chart is this.&lt;/P&gt;&lt;P&gt;- &lt;STRONG&gt;x axis&lt;/STRONG&gt; : test start time&lt;/P&gt;&lt;P&gt;- &lt;STRONG&gt;y axis&lt;/STRONG&gt; : test duration time&lt;/P&gt;&lt;P&gt;- &lt;STRONG&gt;bubble size&lt;/STRONG&gt; : count depend on "x axis" &amp;amp; "y axis"&lt;/P&gt;&lt;P&gt;And this is my code.&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;              | eval start_time_bucket = case(
              start_time &amp;gt;= 0 AND start_time &amp;lt; 5, "0~5",
              start_time &amp;gt;= 5 AND start_time &amp;lt; 10, "5~10",
              start_time &amp;gt;= 10 AND start_time &amp;lt; 15, "10~15",
              start_time &amp;gt;= 15 AND start_time &amp;lt; 20, "15~20",
              true(), "20~")
              | eval duration_bucket=case(
              duration&amp;gt;=0 AND duration &amp;lt; 0.5, "0~0.5",
              duration&amp;gt;=0.5 AND duration &amp;lt; 1, "0.5 ~ 1",
              duration&amp;gt;=1 AND duration &amp;lt; 1.5, "1 ~ 1.5",
              duration&amp;gt;=1.5 AND duration &amp;lt; 2, "1.5 ~ 2",
              duration&amp;gt;=2 AND duration &amp;lt; 2.5, "2 ~ 2.5",
              true(), "2.5 ~"
              )
              | stats count by start_time_bucket, duration_bucket
              | eval bubble_size = count
              | table start_time_bucket, duration_bucket, bubble_size
              | rename start_time_bucket as "Test Start time" duration_bucket as "duration" bubble_size as "Count"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;So when the start_time is 12, and duration is 2, this data counted on bubble size at start_time_bucket = "10~15" and duration_bucket ="2~2.5".&lt;BR /&gt;I have a lot of data on each x &amp;amp; y axis, but It only show the bubble when the start_time_bucket = "0~5" and duration_bucket="0~0.5" like under the picture.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Questioner_0-1721732721677.png" style="width: 979px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/31856iDCB3AC051A6A6147/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Questioner_0-1721732721677.png" alt="Questioner_0-1721732721677.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;How could I solve this problem? when I show this data on table, it shows very well.&lt;/P&gt;</description>
      <pubDate>Tue, 23 Jul 2024 11:07:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694046#M56830</guid>
      <dc:creator>Questioner</dc:creator>
      <dc:date>2024-07-23T11:07:02Z</dc:date>
    </item>
    <item>
      <title>Re: How could I show data using bubble chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694048#M56831</link>
      <description>&lt;P&gt;Try using numeric values for your x and y axis&lt;/P&gt;&lt;LI-CODE lang="markup"&gt; | eval start_time_bucket = 5 * floor(start_time/5)&lt;/LI-CODE&gt;&lt;P&gt;or&lt;/P&gt;&lt;LI-CODE lang="markup"&gt; | bin start_time as start_time_bucket span=5&lt;/LI-CODE&gt;</description>
      <pubDate>Tue, 23 Jul 2024 12:03:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694048#M56831</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-07-23T12:03:36Z</dc:date>
    </item>
    <item>
      <title>Re: How could I show data using bubble chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694114#M56839</link>
      <description>&lt;P&gt;The upper one (|eval ~) work!&lt;/P&gt;&lt;P&gt;But when I refresh the page, the start_time and bubble_size work wrong.&lt;/P&gt;&lt;P&gt;For Example, This is origin data,&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="origin.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/31859iF01AECCA3AB47AEB/image-size/medium?v=v2&amp;amp;px=400" role="button" title="origin.png" alt="origin.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;But when I refresh the page, It show like this.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/31860iC5E0E3121116F5E6/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new.png" alt="new.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;The code is this.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval start_time = starttime_data/1000
              | eval duration = floor(duration_data/ 1000)
              | eval start_time_bucket = 5 * floor(start_time/5)
              | stats count by start_time_bucket, duration
              | eval bubble_size = count
              | table start_time_bucket, duration, bubble_size
              | rename start_time_bucket as "Start time" duration as "Duration"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is this just server problem? or my Code problem?&lt;/P&gt;</description>
      <pubDate>Wed, 24 Jul 2024 01:26:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694114#M56839</guid>
      <dc:creator>Questioner</dc:creator>
      <dc:date>2024-07-24T01:26:56Z</dc:date>
    </item>
    <item>
      <title>Re: How could I show data using bubble chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694131#M56843</link>
      <description>&lt;P&gt;Your code looks fine&lt;/P&gt;</description>
      <pubDate>Wed, 24 Jul 2024 06:18:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-could-I-show-data-using-bubble-chart/m-p/694131#M56843</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-07-24T06:18:06Z</dc:date>
    </item>
  </channel>
</rss>

