Dashboards & Visualizations

Best Practices for Data Visualization from CSV?

lsanmiguel
New Member

So let's say I have a CSV full of data from different fields (in the range A-F):

A B C D E F
X 0 0 0 2 1
Y 0 0 0 1 1
Y 0 0 0 4 1
X 0 0 0 5 1
Z 0 0 0 3 1

I want to make a dashboard that visualizes several different fields against each other in different panels. So far I've been constructing the panels from specific searches (ie: | stats sum("D") by "A") but this runs into the hurdle that for column charts it can only display one color (one data series).

I've been looking into putting the information into a pivot chart since it seems that the editor gives me more flexibility in choosing colors. However I'm not sure the best way to go about this. Any help is appreciated.

0 Karma

lguinn2
Legend

You said "for column charts it can only display one color (one data series)." I may be mis-understanding your meaning, but you can display more by using the chart command instead of stats:

yoursearchhere 
| chart sum(D) by A F

This will make a chart similar to the original, but with each A column split into sub-series by the values of F. However, you can only put 2 fields in the by clause. And this doesn't work if you wanted to compare 2 independent series...

You can also put multiple series in a visualization in this way:

yoursearchhere | stats sum(D) as totalD by B 
| append [ search yoursearchhere | stats sum(D) as totalD by C ]
| append  [ search yoursearchhere | stats sum(D) as totalD by F ]
| stats first(B) as B first(C) as C first(F) as F by totalD

Then choose your visualization. However, this requires that the values of B C and F are quite similar, as they will appear on the X-axis. All of them should be in the same range of values, and all should be either numeric or discrete values.

You may also find the xyseries command helpful for building results that can be visualized in Splunk.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...