Hello All,
I am trying to plot the count of events per day over a span of a week by using scatterplot matrix as the visualization to see if there is any linear relation observed.
And I need to plot 4 charts, one for each week of the month since there are restrictions on number of datapoints a single chart can publish.
But, when I plot more than one chart, the dashboard breaks down and I start getting error: -
Error rendering Scatterplot Matrix visualization
Thus, I need your guidance to resolve the error.
Thank you
Taruchit
Hi @Taruchit,
You can group counts by week of year, which works well for line and column charts:
| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year
and then use trellis to split the charts by week_of_year:
However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:
| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count
and then use trellis to split the scatter chart by week_of_year:
If you prefer, you can use some other split-by value:
| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count
The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:
<option name="charting.chart.markerSize">1</option>
Hi @Taruchit,
You can group counts by week of year, which works well for line and column charts:
| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year
and then use trellis to split the charts by week_of_year:
However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:
| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count
and then use trellis to split the scatter chart by week_of_year:
If you prefer, you can use some other split-by value:
| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count
The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:
<option name="charting.chart.markerSize">1</option>
Hi @tscroggins,
Thank you very much for sharing the detailed inputs and also for also sharing the alternate approaches for exploring.
Thank you