Best Practices for Data Visualization from CSV?

[lsanmiguel]

So let's say I have a CSV full of data from different fields (in the range A-F):

A B C D E F
X 0 0 0 2 1
Y 0 0 0 1 1
Y 0 0 0 4 1
X 0 0 0 5 1
Z 0 0 0 3 1

I want to make a dashboard that visualizes several different fields against each other in different panels. So far I've been constructing the panels from specific searches (ie: | stats sum("D") by "A") but this runs into the hurdle that for column charts it can only display one color (one data series).

I've been looking into putting the information into a pivot chart since it seems that the editor gives me more flexibility in choosing colors. However I'm not sure the best way to go about this. Any help is appreciated.

[lguinn2]

You said "for column charts it can only display one color (one data series)." I may be mis-understanding your meaning, but you can display more by using the chart command instead of stats:

yoursearchhere 
| chart sum(D) by A F

This will make a chart similar to the original, but with each A column split into sub-series by the values of F. However, you can only put 2 fields in the by clause. And this doesn't work if you wanted to compare 2 independent series...

You can also put multiple series in a visualization in this way:

yoursearchhere | stats sum(D) as totalD by B 
| append [ search yoursearchhere | stats sum(D) as totalD by C ]
| append  [ search yoursearchhere | stats sum(D) as totalD by F ]
| stats first(B) as B first(C) as C first(F) as F by totalD

Then choose your visualization. However, this requires that the values of B C and F are quite similar, as they will appear on the X-axis. All of them should be in the same range of values, and all should be either numeric or discrete values.

You may also find the xyseries command helpful for building results that can be visualized in Splunk.