Splunk Search

How to create a scatter graph of chain stores on the y-axis with a dot over each city a store is located long the x-axis?

lyndac
Contributor

I have Splunk indexing a file that contains information about the geographical location of stores:

city, chain, numStores
Pasadena, Walmart, 0
Pasadena, Kmart, 1
Glen Burnie, Walmart, 1
Glen Burnie, Target, 1
Glen Burnie, Kmart, 1
Millersville, Target, 1

I want to be able to plot this data into a scatter chart where the X-axis is the city, the Y-axis is the chain, and the "dot" appears at the intersection where the city has a store (similar to below, but the X's are dots and they are lined up in the column):

Walmart|                       X
KMart  |      X                X
Target |                       X                  X
-----------------------------------------------------------------
           Pasadena       Glen Burnie        Millersville

Try as I might, I cannot even get the axes to display correctly. Is it possible to do what I am asking? I read in the "Data Requirments for Visualizations" document that I need to graph the events directly, so I tried this:
index=foo | fields - _* | fields city, chain (I get no results for this)
index=foo | fields city, chain (I don't see any plots, but the legend shows up with city and _time. The x axis is labeled city, but no values are displayed and the y-axis shows values 50 and 100 which are not even in the data.)

I wish I could paste the graph here, but my Splunk is on a closed instance so I have to retype everything here.

0 Karma
1 Solution

afishkin_splunk
Splunk Employee
Splunk Employee

scatter graph returns number for both Y-Axis and X-Axis
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Datastructurerequirementsforvisualizations and select Scatter charts link on the right panel

View solution in original post

0 Karma

afishkin_splunk
Splunk Employee
Splunk Employee

scatter graph returns number for both Y-Axis and X-Axis
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Datastructurerequirementsforvisualizations and select Scatter charts link on the right panel

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...