Dashboards & Visualizations

How to plot multiple visualizations of type: scatterplot matrix?

Taruchit
Contributor

Hello All,

I am trying to plot the count of events per day over a span of a week by using scatterplot matrix as the visualization to see if there is any linear relation observed.

And I need to plot 4 charts, one for each week of the month since there are restrictions on number of datapoints a single chart can publish.

But, when I plot more than one chart, the dashboard breaks down and I start getting error: -

Error rendering Scatterplot Matrix visualization

Thus, I need your guidance to resolve the error.

Thank you
Taruchit

Labels (3)
0 Karma
1 Solution

tscroggins
Influencer

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

View solution in original post

tscroggins
Influencer

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

Taruchit
Contributor

Hi @tscroggins,

Thank you very much for sharing the detailed inputs and also for also sharing the alternate approaches for exploring.

Thank you

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...