Dashboards & Visualizations

Is it possible to Customize Parallel Coordinates visualization?

restinlinux
Explorer

There is any possible way to sort the parrllel co-ordinates visualization.

....| table count product test

where count is a integer ( number).. In parallel coordinates visualization .

The Number comes first follow by alphabets.

3              Alexa          Ball

Is there possible to make reverse the visualization format

something like

Alexa    Ball        3

0 Karma

PickleRick
SplunkTrust
SplunkTrust

From my tests I think that this visualization does internal sorting of dimensions and you can't change it. Either parameters settable in the UI directly in visualization tab or XML-settable parameters contain anything about sorting. So yes, you can reorder the columns but you can't force any particular order within the columns.

0 Karma

restinlinux
Explorer

Can you brief more how its possible to reorder the col of viz  by xml if possible.

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It you provide column names in different order in your table command, they will be ordered differently.

So if you do

| table count product test

You will have count column first, then product, then test.

If you do

| table test count product

The columns will be ordered differently.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not sure if I understand the requirement, but why not do this

| table product test count
0 Karma

restinlinux
Explorer

Tried using table command to sort the visualization.

The required format is not reflect in Parallel Co ordinates visualization.

The numerical comes first , as before.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Odd, if I create 100 random rows with this example

| makeresults count=100
| fields - _time
| eval count=random() % 10, product=mvindex(split("Alexa,Google,Siri", ","), random() % 3) , test=mvindex(split("Ball,Nest,Watch", ","), random() % 3)
| table product test count

it generates a viz

bowesmana_0-1665559707750.png

What's your SPL?

0 Karma

restinlinux
Explorer

yeah its generates. but my table is ( |table 300 200 hi  ).

The viz comes in the format as

300    200     hi     --- number first followed by alphabets....

but i want to sort the viz format something like hi  200 300.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What's your exact SPL for your table statement. The viz will generally honour the ordering specified in the table, but it seems sometimes it does not.

You can rename your fields, e.g. this appears to get changed in my test to 200, 300, hi

| table 300 200 hi

 but if you do this

| rename 300 as e_300, 200 as e_200
| table e_300 e_200 hi

it puts them in the order specified

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...