Dashboards & Visualizations

Is it possible to Customize Parallel Coordinates visualization?

restinlinux
Explorer

There is any possible way to sort the parrllel co-ordinates visualization.

....| table count product test

where count is a integer ( number).. In parallel coordinates visualization .

The Number comes first follow by alphabets.

3              Alexa          Ball

Is there possible to make reverse the visualization format

something like

Alexa    Ball        3

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

From my tests I think that this visualization does internal sorting of dimensions and you can't change it. Either parameters settable in the UI directly in visualization tab or XML-settable parameters contain anything about sorting. So yes, you can reorder the columns but you can't force any particular order within the columns.

0 Karma

restinlinux
Explorer

Can you brief more how its possible to reorder the col of viz  by xml if possible.

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It you provide column names in different order in your table command, they will be ordered differently.

So if you do

| table count product test

You will have count column first, then product, then test.

If you do

| table test count product

The columns will be ordered differently.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not sure if I understand the requirement, but why not do this

| table product test count
0 Karma

restinlinux
Explorer

Tried using table command to sort the visualization.

The required format is not reflect in Parallel Co ordinates visualization.

The numerical comes first , as before.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Odd, if I create 100 random rows with this example

| makeresults count=100
| fields - _time
| eval count=random() % 10, product=mvindex(split("Alexa,Google,Siri", ","), random() % 3) , test=mvindex(split("Ball,Nest,Watch", ","), random() % 3)
| table product test count

it generates a viz

bowesmana_0-1665559707750.png

What's your SPL?

0 Karma

restinlinux
Explorer

yeah its generates. but my table is ( |table 300 200 hi  ).

The viz comes in the format as

300    200     hi     --- number first followed by alphabets....

but i want to sort the viz format something like hi  200 300.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What's your exact SPL for your table statement. The viz will generally honour the ordering specified in the table, but it seems sometimes it does not.

You can rename your fields, e.g. this appears to get changed in my test to 200, 300, hi

| table 300 200 hi

 but if you do this

| rename 300 as e_300, 200 as e_200
| table e_300 e_200 hi

it puts them in the order specified

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...