Dashboards & Visualizations

How to plot multiple visualizations of type: scatterplot matrix?

Taruchit
Contributor

Hello All,

I am trying to plot the count of events per day over a span of a week by using scatterplot matrix as the visualization to see if there is any linear relation observed.

And I need to plot 4 charts, one for each week of the month since there are restrictions on number of datapoints a single chart can publish.

But, when I plot more than one chart, the dashboard breaks down and I start getting error: -

Error rendering Scatterplot Matrix visualization

Thus, I need your guidance to resolve the error.

Thank you
Taruchit

Labels (3)
0 Karma
1 Solution

tscroggins
Influencer

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

View solution in original post

tscroggins
Influencer

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

Taruchit
Contributor

Hi @tscroggins,

Thank you very much for sharing the detailed inputs and also for also sharing the alternate approaches for exploring.

Thank you

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...