Dashboards & Visualizations

category chart for discrete data set


I have a field with a small set of possible text values.

I'd like to plot the value of that field over time.

As a first pass I used eval to convert the text values to numerical values. Then I was messing around with changing the labels when I saw on this documentation page: http://www.splunk.com/base/Documentation/4.1.7/Developer/CustomChartingConfig-AxisGrid#categoryaxes

That there was a "category" chart type. I'm curious how that sort of chart works and if I can use it to graph a string-state value.


Y-Axis values:

  • red
  • amber
  • yellow
  • green

X-Axis values:

  • timestamps

I gave it a try, but it didn't seem to work. Does it work this way? Am I reading too much into the option?

Tags (1)


Sounds like you're trying to chart OVER distinct values, use something like this.  | chart max(delay) over foo by bar

0 Karma


Also I have another one that is either True or False. I'd like to be able to plot a square wave for the data toggling back and forth, and I'd like it to be obvious that a "0" is 'true' and a "1" is 'false'.

0 Karma


The way I was doing it with eval, green = 0, yellow = 1, amber = 2, red = 3. Then I was timecharting max(color) for the timespan bins. However the y-axis was labeled with numbers and I'd rather have the color names there. So I was hoping I could use a category chart and skip the eval step, and graph every event (rather than bucketing the events in windows). The events aren't very frequent, so my data density is low.

0 Karma

Splunk Employee
Splunk Employee

Not sure I understand what the y-axis is. how would you chart "red" on an axis and distinguish it from "green". Is there a corresponding number or range that means "red", or do you want to chart the count of "red" values, "green" values, etc.?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...