Dashboards & Visualizations

Scatter Plot with non-numeric y values

New Member

My data table looks like this:

Product TimeOfSale
Shirt   5/2/13 5:00:00.000 PM  
Shirt   5/2/13 6:00:00.000 PM  
Slacks  5/2/13 6:00:00.000 PM  
Jacket  5/2/13 7:00:00.000 PM  
Slacks  5/2/13 8:00:00.000 PM  

How would I create a Scatter Plot (or some chart) where distinct products are listed on the Y-Axis and Time_Of_Sale is the X-Axis. I need a tick mark plotted for each Product for the appropriate TimeOfSale.

Essentially, I need something like:

Shirt      x    x
Slacks          x         x
Jacket               x  
          5pm  6pm  7pm  8pm

Thanks, Tom

0 Karma


One way, would be to create a lookup table assigning a numberic value to each item. So that Jacket=1, Slacks=2, Shirt=3. Then use the lookup command to convert. This assumes that the item list is known.

| lookup item_string_to_number item_name OUTPUT item_id

Then use item_id as your y-axis value


0 Karma

New Member

Thanks Mike, I used your suggestion (via a slightly different approach. I used a join with | streamstats count as item_id). The revised table now has an item_id representing a numeric y-value. There is still one problem.

My search looks like this:

... | chart values(item_id) over _time by Product

While a 'line' Chart type plots reasonably, a 'scatter' does not. Is there anything peculiar with my data or search that breaks a scatter ?

Thanks again, Tom

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...