topic Data Visualization Collision in Splunk Search

Data Visualization Collision

zgoda — Wed, 15 Aug 2018 22:13:38 GMT

Hi all,

I am having trouble with data visualizations. Two of my data points are layered on top of each other. I have tried adjusting the scale and size of the visualization and can't figure it out. Does anyone know how to fix this collision?

Thanks in advance

Re: Data Visualization Collision

pruthvikrishnap — Wed, 15 Aug 2018 22:19:03 GMT

Hi,
Try using the Chart option and in Y-Axis you can change the scale from Log to Linear and add some visualizations to it.
Put 0 in Min Value and 800 for the Max Value.
Let me know if this helps.

Re: Data Visualization Collision

zgoda — Wed, 15 Aug 2018 22:50:56 GMT

Hi,

Thank you for the suggestions. I tried your suggestions and was unable to correct my problem.

Re: Data Visualization Collision

niketn — Thu, 16 Aug 2018 02:38:43 GMT

@zgoda, since there are multiple data values present at the same point in chart they will overlay each other. So, your options would be to

1) Split the series using Multi-Series mode from UI > Edit > Format Visualization > General tab. Refer to documentation:
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ColumnBarCharts#Multiple_series_options
https://docs.splunk.com/Documentation/Splunk/latest/Viz/LineAreaCharts#Multiple_series_options
This way series will be plotted in two separate areas within the same chart with their own x-axis.

2) Use CSS to hide the series for either Columns or Overlaid Line series as per your need.

Re: Data Visualization Collision

zgoda — Thu, 16 Aug 2018 14:20:52 GMT

Hey nikenilay,

I am new to making dashboards. Do you happen to have some sample css to hide the columns?

Thanks in advance

Re: Data Visualization Collision

niketn — Thu, 16 Aug 2018 14:57:24 GMT

@zgoda, refer to this old answer of mine: https://answers.splunk.com/answers/610389/how-to-display-values-only-for-chart-overlay-field.html

If you are new to CSS you can refer to another answer of mine as to how to begin your CSS Journey within Splunk Dashboards: https://answers.splunk.com/answers/590387/how-do-i-update-panel-color-in-splunk-using-css-1.html

Do try out split to Multi-Series Option as well as suggested in above comment.