Dashboards & Visualizations

How to plot multiple visualizations of type: scatterplot matrix?

Taruchit
Contributor

Hello All,

I am trying to plot the count of events per day over a span of a week by using scatterplot matrix as the visualization to see if there is any linear relation observed.

And I need to plot 4 charts, one for each week of the month since there are restrictions on number of datapoints a single chart can publish.

But, when I plot more than one chart, the dashboard breaks down and I start getting error: -

Error rendering Scatterplot Matrix visualization

Thus, I need your guidance to resolve the error.

Thank you
Taruchit

Labels (3)
0 Karma
1 Solution

tscroggins
Champion

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

View solution in original post

tscroggins
Champion

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

Taruchit
Contributor

Hi @tscroggins,

Thank you very much for sharing the detailed inputs and also for also sharing the alternate approaches for exploring.

Thank you

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...