Dashboards & Visualizations

Force query result to display as chart

travis_bear
Explorer

I have the following query in Splunk 5:

index=summary
report=hw_use_by_jobs 
orig_host="my_host" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
   over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints | 
fields "ConcurrentTasks" "Percent of Time"  "p50 CPU"

The output of this query is a table of numeric data, with a UI option I can click to display the results as a graphical chart. Is there any way I can specify in the query itself that I want the data to display initially as a chart instead of as a table?

My goal is to stick this chart into a view, so if there is a better approach to doing this in the query itself, I'm open to that as well.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


View solution in original post

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table). Simple xml example"-

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>IndexStats</label>
 <!-- Place panels within rows -->
  <row>
    <table>
      <title>Top Sourcetypes (Last 24 hours)</title>
      <!-- A search powers the panel -->
      <searchString>
       ****You search query****
      </searchString>

      <!-- Specify a time range for the search -->
      <earliestTime>-24h@h</earliestTime>
      <latestTime>now</latestTime>

      <!-- Use options to further define how to display result data -->
      <option name="wrap">true</option>
      <option name="rowNumbers">true</option>
    </table>
  </row>
  <row>
    <chart>
      <title>PerIndexThruputChart</title>
       <searchString>
       ****You search query****
      </searchString>
  <!-- Specify a time range for the search -->
  <earliestTime>-24h@h</earliestTime>
  <latestTime>now</latestTime>

  <!-- Use options to further define how to display result data -->
  <option name="charting.chart">bar</option>
</chart>


travis_bear
Explorer

Thank you that was helpful!

0 Karma

travis_bear
Explorer

@somesoni -- That's helpful. If you submit your comment as an answer, I will accept it. If you include a simple xml example, I will upvote it as well.

0 Karma

somesoni2
Revered Legend

When you will put this search in a dashboard/view, you can specify which format you want it to be displayed in view-panel (chart or table).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...