Dashboards & Visualizations

How to effectively implement a Bubble Chart?

Phil219
Path Finder

Hello,

I am trying to merge two charts together. Both charts have two dimensions each with one common dimension - making three total.

Following the advice given in link text, I use the following search to return a string, number, number:

MY SEARCH | stats sum(count) by location date_month

Which returns results in the "statistics" tab that look something like this:

Location, date_month, count
Copper River, 5, 300
Copper River, 6, 300
Copper River, 7, 325
Bear River, 5, 120
Bear River, 6, 200
Bear River, 7, 177

etc

Unfortunately, when I click the "visualization" tab and select "bubble" the table is blank. What did I do wrong?

I have also tried to understand and follow the advice given link text but it appears that in the example link text, the search results need to yield four fields to use the bubble visualization properly.

It seems there is an easy way to implement the "bubble" feature of splunk search visualization and I am just missing it. Any suggestions?

Thank you in advance!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Check the bubble chart example from the Splunk 6.x Dashboard example app (https://splunkbase.splunk.com/app/1603/).

It needs 4 columns with 3 columns (from 2nd to 4th) to be of numeric type. The bubble chart displays the data in 3 dimensions for the series (first column).

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Check the bubble chart example from the Splunk 6.x Dashboard example app (https://splunkbase.splunk.com/app/1603/).

It needs 4 columns with 3 columns (from 2nd to 4th) to be of numeric type. The bubble chart displays the data in 3 dimensions for the series (first column).

Phil219
Path Finder

You are right somesoni2! Thank you!

MY SEARCH | table location, _time, count,Species_ID

Yielded:

Location, _time, count, Species_ID
Afognak River, 2015-05-11, 2, 420
Copper River, 2015-05-12, 6, 420
Afognak River, 2015-05-12, 11, 420
Copper River, 2015-05-13, 145, 420
Afognak River, 2015-05-13, 7, 420

etc.

Which, when I clicked the "visualization" tab, turned into a really cool bubble chart. Thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...