Dashboards & Visualizations

How to read a fourth value from scatter plot?

Oti47
Path Finder

Hello,
I have a problem,
how do I get a fourth value from a table and scatterplot to use the value in a token?

We have a table with 4 columns and a scatterplot chart for display.

article, value, calculate category and PartnerId

Unfortunately, the PartnerId is not displayed in the scatterplot chart.
Can I somehow read out the fourth value to display further details on a PartnerID in a dashboard?

Labels (5)
0 Karma

tscroggins
Influencer

Hi @Oti47,

Edit: This answer applies to Simple XML dashboards. Dashboard Studio may be limited to a single category field, as @richgalloway noted.

Edit 2: Snap. The Dashboard Studio scatter visualization is limited to x, y, and category fields in that order.

The search fragment for the scatter chart visualization provides a hint:

| stats x_value_aggregation y_value_aggregation by name_category [comparison_category]

If you're using a report, output from the inputlookup or table command, etc., make sure the fields are in name_category, comparison_category, x_value_aggregation, y_value-aggregation order by applying the stats command:

| stats values(category) as category values(value) as value by PartnerId article

where PartnerId and article are categorical values and category and value are numerical values. You can re-order the aggregation fields, category and value, and the split-by fields, PartnerId and article, as needed for your intended display:

| stats values(value) as value values(category ) as category by article PartnerId

Reformatting the output with the stats command adds the user interface field metadata (groupby_rank) used by the visualization to identify the name_category ("groupby_rank": 0) and comparison_category ("groupby_rank": 1) fields.

As a rule of thumb, the commands referenced in a visualization's search fragment will produce the desired result. Visualizations that reference chart, stats, timechart, xyseries, etc. most likely use internal metadata to format their output.

You can then use drilldown tokens associated with the data. See <https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Predefined_dr.... $click.value$ should represent the scatter chart name_category value, and $click.value2$ should represent the scatter chart comparison_category value.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Scatter plots are two-dimensional so they take 3 arguments: value, x-axis, and y-axis.  A fourth argument would call for a three-dimensional chart and that calls for an add-on like https://splunkbase.splunk.com/app/3138.  See https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/ScatterChart

---
If this reply helps you, Karma would be appreciated.
0 Karma

Oti47
Path Finder

Hello,
two dimensions are enough.
I only need the PartnerID as a value at the measuring point to branch from the display to another detail dashboard.

Are there any ideas?

 

Regards

Michael 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For a 2-D plot, you'll have to somehow reduce the number of arguments to 3.  Perhaps you can concatenate two of the values (| eval foo=bar . baz) and graph the remaining three.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...