Dashboards & Visualizations

## How could I show data using bubble chart?

Path Finder

- x axis : test start time

- y axis : test duration time

- bubble size : count depend on "x axis" & "y axis"

And this is my code.

``````              | eval start_time_bucket = case(
start_time >= 0 AND start_time < 5, "0~5",
start_time >= 5 AND start_time < 10, "5~10",
start_time >= 10 AND start_time < 15, "10~15",
start_time >= 15 AND start_time < 20, "15~20",
true(), "20~")
| eval duration_bucket=case(
duration>=0 AND duration < 0.5, "0~0.5",
duration>=0.5 AND duration < 1, "0.5 ~ 1",
duration>=1 AND duration < 1.5, "1 ~ 1.5",
duration>=1.5 AND duration < 2, "1.5 ~ 2",
duration>=2 AND duration < 2.5, "2 ~ 2.5",
true(), "2.5 ~"
)
| stats count by start_time_bucket, duration_bucket
| eval bubble_size = count
| table start_time_bucket, duration_bucket, bubble_size
| rename start_time_bucket as "Test Start time" duration_bucket as "duration" bubble_size as "Count"``````

So when the start_time is 12, and duration is 2, this data counted on bubble size at start_time_bucket = "10~15" and duration_bucket ="2~2.5".
I have a lot of data on each x & y axis, but It only show the bubble when the start_time_bucket = "0~5" and duration_bucket="0~0.5" like under the picture.

How could I solve this problem? when I show this data on table, it shows very well.

Labels (1)
• ### chart

Tags (2)
1 Solution
SplunkTrust

Try using numeric values for your x and y axis

`` | eval start_time_bucket = 5 * floor(start_time/5)``

or

`` | bin start_time as start_time_bucket span=5``
SplunkTrust

Try using numeric values for your x and y axis

`` | eval start_time_bucket = 5 * floor(start_time/5)``

or

`` | bin start_time as start_time_bucket span=5``
Path Finder

The upper one (|eval ~) work!

But when I refresh the page, the start_time and bubble_size work wrong.

For Example, This is origin data,

But when I refresh the page, It show like this.

The code is this.

``````| eval start_time = starttime_data/1000
| eval duration = floor(duration_data/ 1000)
| eval start_time_bucket = 5 * floor(start_time/5)
| stats count by start_time_bucket, duration
| eval bubble_size = count
| table start_time_bucket, duration, bubble_size
| rename start_time_bucket as "Start time" duration as "Duration"``````

Is this just server problem? or my Code problem?

SplunkTrust

Get Updates on the Splunk Community!

#### 3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

#### What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

#### Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...