Dashboards & Visualizations

How to read a fourth value from scatter plot?

Oti47
Path Finder

Hello,
I have a problem,
how do I get a fourth value from a table and scatterplot to use the value in a token?

We have a table with 4 columns and a scatterplot chart for display.

article, value, calculate category and PartnerId

Unfortunately, the PartnerId is not displayed in the scatterplot chart.
Can I somehow read out the fourth value to display further details on a PartnerID in a dashboard?

Labels (5)
0 Karma

tscroggins
Influencer

Hi @Oti47,

Edit: This answer applies to Simple XML dashboards. Dashboard Studio may be limited to a single category field, as @richgalloway noted.

Edit 2: Snap. The Dashboard Studio scatter visualization is limited to x, y, and category fields in that order.

The search fragment for the scatter chart visualization provides a hint:

| stats x_value_aggregation y_value_aggregation by name_category [comparison_category]

If you're using a report, output from the inputlookup or table command, etc., make sure the fields are in name_category, comparison_category, x_value_aggregation, y_value-aggregation order by applying the stats command:

| stats values(category) as category values(value) as value by PartnerId article

where PartnerId and article are categorical values and category and value are numerical values. You can re-order the aggregation fields, category and value, and the split-by fields, PartnerId and article, as needed for your intended display:

| stats values(value) as value values(category ) as category by article PartnerId

Reformatting the output with the stats command adds the user interface field metadata (groupby_rank) used by the visualization to identify the name_category ("groupby_rank": 0) and comparison_category ("groupby_rank": 1) fields.

As a rule of thumb, the commands referenced in a visualization's search fragment will produce the desired result. Visualizations that reference chart, stats, timechart, xyseries, etc. most likely use internal metadata to format their output.

You can then use drilldown tokens associated with the data. See <https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Predefined_dr.... $click.value$ should represent the scatter chart name_category value, and $click.value2$ should represent the scatter chart comparison_category value.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Scatter plots are two-dimensional so they take 3 arguments: value, x-axis, and y-axis.  A fourth argument would call for a three-dimensional chart and that calls for an add-on like https://splunkbase.splunk.com/app/3138.  See https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/ScatterChart

---
If this reply helps you, Karma would be appreciated.
0 Karma

Oti47
Path Finder

Hello,
two dimensions are enough.
I only need the PartnerID as a value at the measuring point to branch from the display to another detail dashboard.

Are there any ideas?

 

Regards

Michael 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For a 2-D plot, you'll have to somehow reduce the number of arguments to 3.  Perhaps you can concatenate two of the values (| eval foo=bar . baz) and graph the remaining three.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...