Dashboards & Visualizations

Is it possible to Customize Parallel Coordinates visualization?

restinlinux
Explorer

There is any possible way to sort the parrllel co-ordinates visualization.

....| table count product test

where count is a integer ( number).. In parallel coordinates visualization .

The Number comes first follow by alphabets.

3              Alexa          Ball

Is there possible to make reverse the visualization format

something like

Alexa    Ball        3

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

From my tests I think that this visualization does internal sorting of dimensions and you can't change it. Either parameters settable in the UI directly in visualization tab or XML-settable parameters contain anything about sorting. So yes, you can reorder the columns but you can't force any particular order within the columns.

0 Karma

restinlinux
Explorer

Can you brief more how its possible to reorder the col of viz  by xml if possible.

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It you provide column names in different order in your table command, they will be ordered differently.

So if you do

| table count product test

You will have count column first, then product, then test.

If you do

| table test count product

The columns will be ordered differently.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not sure if I understand the requirement, but why not do this

| table product test count
0 Karma

restinlinux
Explorer

Tried using table command to sort the visualization.

The required format is not reflect in Parallel Co ordinates visualization.

The numerical comes first , as before.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Odd, if I create 100 random rows with this example

| makeresults count=100
| fields - _time
| eval count=random() % 10, product=mvindex(split("Alexa,Google,Siri", ","), random() % 3) , test=mvindex(split("Ball,Nest,Watch", ","), random() % 3)
| table product test count

it generates a viz

bowesmana_0-1665559707750.png

What's your SPL?

0 Karma

restinlinux
Explorer

yeah its generates. but my table is ( |table 300 200 hi  ).

The viz comes in the format as

300    200     hi     --- number first followed by alphabets....

but i want to sort the viz format something like hi  200 300.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What's your exact SPL for your table statement. The viz will generally honour the ordering specified in the table, but it seems sometimes it does not.

You can rename your fields, e.g. this appears to get changed in my test to 200, 300, hi

| table 300 200 hi

 but if you do this

| rename 300 as e_300, 200 as e_200
| table e_300 e_200 hi

it puts them in the order specified

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...