Dashboards & Visualizations

How to plot multiple visualizations of type: scatterplot matrix?

Taruchit
Contributor

Hello All,

I am trying to plot the count of events per day over a span of a week by using scatterplot matrix as the visualization to see if there is any linear relation observed.

And I need to plot 4 charts, one for each week of the month since there are restrictions on number of datapoints a single chart can publish.

But, when I plot more than one chart, the dashboard breaks down and I start getting error: -

Error rendering Scatterplot Matrix visualization

Thus, I need your guidance to resolve the error.

Thank you
Taruchit

Labels (3)
0 Karma
1 Solution

tscroggins
Influencer

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

View solution in original post

tscroggins
Influencer

Hi @Taruchit,

You can group counts by week of year, which works well for line and column charts:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| timechart span=1d count as count by week_of_year

tscroggins_0-1695521875046.png

and then use trellis to split the charts by week_of_year:

tscroggins_1-1695521906979.png

However, scatter charts want integral x and y-values. You can use strftime again to convert _time values into reasonable integer values, e.g. the day of the week:

| timechart span=1d count
| eval week_of_year=strftime(_time, "%V")
| eval day_of_week=strftime(_time, "%w")
| xyseries day_of_week week_of_year count

and then use trellis to split the scatter chart by week_of_year:

tscroggins_4-1695521995780.png

If you prefer, you can use some other split-by value:

| timechart span=1d count
| eval day_of_week=strftime(_time, "%w")
| eval split_by="Week of ".strftime(_time-(86400*day_of_week), "%d-%b")
| xyseries day_of_week split_by count

tscroggins_5-1695522015935.png

The markers can be made slightly more visually appealing using a Simple XML dashboard and the charting.chart.markerSize option:

<option name="charting.chart.markerSize">1</option>

tscroggins_6-1695522246960.png

Taruchit
Contributor

Hi @tscroggins,

Thank you very much for sharing the detailed inputs and also for also sharing the alternate approaches for exploring.

Thank you

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...