Dashboards & Visualizations

Best Practices for Data Visualization from CSV?

lsanmiguel
New Member

So let's say I have a CSV full of data from different fields (in the range A-F):

A B C D E F
X 0 0 0 2 1
Y 0 0 0 1 1
Y 0 0 0 4 1
X 0 0 0 5 1
Z 0 0 0 3 1

I want to make a dashboard that visualizes several different fields against each other in different panels. So far I've been constructing the panels from specific searches (ie: | stats sum("D") by "A") but this runs into the hurdle that for column charts it can only display one color (one data series).

I've been looking into putting the information into a pivot chart since it seems that the editor gives me more flexibility in choosing colors. However I'm not sure the best way to go about this. Any help is appreciated.

0 Karma

lguinn2
Legend

You said "for column charts it can only display one color (one data series)." I may be mis-understanding your meaning, but you can display more by using the chart command instead of stats:

yoursearchhere 
| chart sum(D) by A F

This will make a chart similar to the original, but with each A column split into sub-series by the values of F. However, you can only put 2 fields in the by clause. And this doesn't work if you wanted to compare 2 independent series...

You can also put multiple series in a visualization in this way:

yoursearchhere | stats sum(D) as totalD by B 
| append [ search yoursearchhere | stats sum(D) as totalD by C ]
| append  [ search yoursearchhere | stats sum(D) as totalD by F ]
| stats first(B) as B first(C) as C first(F) as F by totalD

Then choose your visualization. However, this requires that the values of B C and F are quite similar, as they will appear on the X-axis. All of them should be in the same range of values, and all should be either numeric or discrete values.

You may also find the xyseries command helpful for building results that can be visualized in Splunk.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...