Splunk: Pivot charts and visualizations with Pivot Editor

In this section, we are going to learn about the creation of Pivot charts, visualizations and the Pivot editor. Along with this, we will also learn about the color, x-axis, y-axis, labels and many other attributes of the charts.

Design pivot charts and visualizations with Pivot Editor

We need to select the visualization type from the black sidebar that runs down the Editor's left-hand side to define a data visualization with the Pivot Editor. The charts and visualizations of the data are listed as follows:

Table
Column chart
Bar chart
Scatter chart
Area chart
Line chart
Pie chart
Single value visualization
Radial gauge
Marker gauge
Filler gauge

It's helpful (but not necessary) to understand how pivot tables work before building pivot charts and visualizations. We suggest we start building our Pivot as a table and then switch to our chosen visualization.

On switching between Pivot visualization types

When switching between pivot visualizations, Pivot will find the pivot elements we need to build the visualization. We will discard the elements we don't need an alert when we need to identify the elements. This applies if we switch between tables and charts, as well as between types of charts.

For example: If we switch our Pivot from table mode to column chart mode but have not defined a split row element while it is in table mode, the column chart Y-Axis control panel will be yellow and marked Required. Pivot will not create a column chart until we select a field for the x-axis of the chart.

If no fields are available for a map or single data visualization control panel segment in the selected pivot dataset, then that panel segment will not be displayed.

Take an example, if we are working with a data model dataset that does not have a time field, when we switch from the pivot table view to the column chart visualization type, the Time Range control panel will not be available.

When we select a type of visualization that can only use a specific field to fill in a required control panel, that control panel will be pre-populated when we select the type of visualization. For example, when we turn from a column chart to a line or area chart. The X-Axis control will be pre-populated with the time, even though the column chart view shows a different field selected for the x-axis.

If we switch from one form of visualization to another in the Pivot Editor, the visualization on which we land will display the elements used by the chart or visualization from which we came, with the exception of those which it can not use. If, after looking at the data as a column chart, we return to the pivot table mode and see the same table that we left, it is probably because the column chart was able to use all the pivot elements as originally set. If we do not want to sacrifice our pivot visualization configuration when switching to another form of visualization, we can save it first as a chart.

Controls that are common to all charts and single value visualizations

Time Range and Filter controls are specific to all of the Pivot Editor chart forms and single value visualizations (including gauges) that are provided

Time Range

The control panel on Time Range works just like the time range menu in use in Splunk Site. It corresponds to the filter element in pivot tables with the time range.

Filter

We may set up multiple filters on specific dataset fields in the Filter control panel, to narrow down the map or visualization recorded data collection. The filter controls work in the same way they do in a pivot table for filter elements.

Column and bar chart controls

Column charts and bar charts use the same controls. Only two differences do exist:

The x-axis for bar charts is the vertical axis, whereas the horizontal axis is the y-axis. In other words, for column charts, the x-axis and y-axis are reversed from the way they are setup.
Column charts let column labels rotate. Choose the way we want to display Label Rotation on our column labels.

Column charts and bar charts use the same controls. Only two differences do exist:

The x-axis for bar charts is the vertical axis, whereas the horizontal axis is the y-axis. In other words, for column charts, the x-axis and y-axis are reversed from the way they are setup.

Column charts let column labels rotate. Choose the way we want to display Label Rotation on our column labels.

Column and bar charts consist of the definition of elements of the x-axis and y-axis. Without these, Splunk software can not render the charts.

Important: The Pivot Editor built-in column charts have zoom and pan functionality. We can pick a part of the map with our mouse to zoom in on it. When we've zoomed in, we can pan along the x-axis using the left and right arrows. Press Reset to zoom back to the original map.

X-Axis

The X-Axis must be defined with a field to render a column or bar chart. The control panel X-Axis corresponds to the form of a split row pivot element and shares its options for configuration.

The control panel on the X-Axis also includes these controls specific to the chart:

Label lets us replace the x-axis with an alternative label, or cover the x-axis label entirely.

Label Rotation lets us determine how column labels with x-axis are displayed along the x-axis.

Truncation is only possible when the labels of the x-axis columns have a value of Label Rotation, not 0 °. Truncate overlong labels to change it to Yes.

Note: Keep in mind that the X-Axis and Y-Axis swap places for bar charts.

Y-Axis

To render a column chart, the axis-Y must be defined with a field that uses an aggregation operation i.e., count, distinct count, average, sum, etc.to output a number. The axis-Y control panel responds to the column value pivot element type and also shares its configuration options.

Note: By selecting distinct count for a field with high cardinality (such as Name or Phone Number ) can slow pivot performance.

The Y-Axis control panel also consists of these chart-specific controls:

Scale toggles the axis scale between linear and logarithmic. This scale can be useful for charts where there is a wide range separating the y-axis values in the chart (where some are extremely high while others are extremely low).

Interval lets us enter a numerical value to control the tick interval on the y-axis.

Min Value and Max Value is where we can enter numerical values to focus the y-axis range. For example, if all of our column chart's y-axis values are above 100 and below 150, we might want to constrain the range to those min and max values; it can make the differences between the columns.

The Y-Axis control panel includes a Label field that enables us to provide an alternate label for the y-axis, or we can say that it hides the y-axis label altogether.

Color

Optionally we can use the Color control panel to break out the results of our chart into series. They are sets of colored columns or bars, representing different field values. For example, we might set up a column chart showing Webstore buying attempts in the past few weeks ( time, on the x-axis), broken out by successful and failed attempts. For this case, the two types of attempts?successful and failed?would be the color. If the x-axis is split out by day, we'll see two columns every day ? blue columns for buying achievements, and yellow columns for buying failures (our colors might differ).

The Color control panel corresponds to the split column's pivot element type and shares its configuration options.

These color/sequence basic controls are also included in the Color control panel:

The place manages the iconic place.

Truncation controls how to truncate the legend labels when they're too long.

Stack mode helps us to stack colors. We can have 100 percent Stacked and Stacked Stacking colors enhance chart readability when involving multiple colors (series) because they make it easy to quickly assess the relative weight (importance) of the various data types that make up a specific dataset.

The Stacked 100 percent alternative allows us to compare data distributions within a column or bar by making it conform to 100 percent of the chart's length or width and display its segments in terms of their 100 percent ratio. Stacked 100% will help we better see the distribution of data between segments in a column or bar chart containing a mixture of very small and very large stacks while stacking when Stack Mode is just set to Stacked.

Area and line chart controls

They use most of the same controls as column and bar charts. The primary difference is that we can only use time as our x-axis region in Pivot, line, and area charts. If the x-axis does not have time, the types of lines and area charts are not available.

Pivot can not render area and line charts like column and row charts until we define a Y-axis field for them.

The Color and General control panels are designed for area and line charts in the same way as they are for column and bar charts (see above)?Control Panels for the Time Range and Filter.

Important: The Pivot Editor built-in area and line charts have zoom and pan functionality. We can select a section of the chart with our mouse to zoom in on it. Once we've zoomed in, we can pan along the x-axis using the left and right arrows. Click Reset to zoom back to the original chart.

X-Axis

As described above, the X-Axis control panel allows only the time timestamp field for line and area charts, since line and area charts are only time charts, showing a shift in the numeric value over time. Otherwise, the control panel is designed in the same way that split-row pivot elements are.

Also included in the X-Axis control panel are these controls which are unique to the chart:

Label lets us hide the Label on the x-axis (we can't rename the field time).

Label Rotation lets us decide how interval labels of x-axis ticks show along the x-axis.

Truncation is only available when the interval labels of x-axis ticks have a Label Rotation value that is not 0 °. Truncate overlong labels to switch it to Yes.

Y-Axis

Line and area charts arrange their details on the y-axis in the same manner as column and bar charts (see above). The only difference is that there is one additional y-axis power over line and area maps. Null Value Mode lets us determine how the chart should handle null values. They can be removed, viewed like zeros, or linked through them.

Scatter chart controls

Although scatter charts are similar to column, bar, line, and area charts in appearance, they are set differently. There are four dimensions of them:

A required Mark control that creates a mark for each unique value of its field on the scatter chart.
Required numerical x- and y-axis ranges, used to map the scatter-plot mark position.
Optional Color control ensures the same color for all scatter chart marks sharing a particular value with their field.

The General control panel is designed for scatter charts in the same way as the column and bar charts.

Mark

Scatter charts need a field for the Mark control panel, which creates a mark for each unique value of the field supplied on the scatter chart. The Mark control panel corresponds to the type of split row pivot element and shares its options for configuration, except that it does not allow us to override the field label.

The Mark field reply to the first split row element present in a pivot table while the Color field reply to the second split row element if one is defined. Splunk software won't let us explain the same field for both Mark and Color; if we select one field in one, it won't be available when we define the other field.

X-Axis and Y-Axis

Scatter charts include fields for the control panels of the X-Axis and Y-Axis, which are used by Splunk software to map the scatter charts. Both controls correspond to the type of pivoting feature in the column value and share its configuration options. The scatter chart X-Axis controls the use of the first column value element in a pivot table, while the controllers Y-Axis use the second column value element if one is defined.

The control panels for the X-Axis and Y-Axis include these controls specific to the chart:

Scale toggles a linear to logarithmic axis size. The logarithmic scale is also useful for charts where the axis values in the chart are separated by a wide range (where some values are extremely high, while others are extremely low).

Interval allows us to insert numerical values to monitor the axis of the tick intervals.

Min Value and Max Value are where numerical values can be entered to focus on-axis range. This can make it easier to see the differences between a number of values nearby together. For example, if all of our scatter chart marks are above 100 and below 110 on the y-axis, we may want to limit the range to certain min and max values to make the variations more noticeable.

The X-Axis control panel has additional x-axis label controls:

The X-Axis control panel has additional x-axis label controls:

Label Rotation lets us decide how interval labels of x-axis ticks show along the x-axis.

Truncation is only available when the interval labels of x-axis ticks have a Label Rotation value that is not 0 °. Truncate overlong labels to set it to Yes.

Color

Defining a field for the Color Panel is optional for scatter charts. The Color control panel corresponds to the type of split row pivot element and shares its setup options. It ensures that all scatter chart marks that share a particular value with their field are of the same color.

The field Color corresponds, if one is defined, to the second split row element in the pivot table definition. As such, it offers a second degree of the splitting of the row beyond the Mark field 's compulsory split-section.

Additionally, the Color controls for scatter charts allow us to hide or override the field label with a new label. It also includes fields specific to the legend of the chart: Position and Truncation.

The position manages the iconic place.

Truncation regulates how to truncate the legend labels when they're too long.

Pie chart controls

Pie charts are relatively simple, as they use the split element in the first row and the element in the first column value in a pivot. The row's divided element determines the number of slices in the pie, its labels, and colors. The value element for the columns determines the size of each pie slice relative to the others. These elements refer to the Color and Size controls in the Pivot chart editing system for the pie chart.

The Time Range, Filter, and General controls are also used in Pie charts. The General controls have the same configuration as the column and bar charts for details regarding the control panels Time Range and Filter.

Color

All fields for the Color control panel pie chart correspond directly to the pivot element type of the split-line. The Color controls determine the number of pie slices, their labels, and colors in the pie.

Size

All fields for the Size control panel in the pie chart correspond directly to the type of pivot variable in the column value. The controls on Size decide the size of each pie slice relative to each other.

Single value visualization controls

Visualizations of a single value return only one number that can optionally be bracketed with the label text. They use a single pivot variable for the column value.

Use the controls Time Range and Filter to filter the results returned by the pivot element of a single column value, as appropriate.

Value

The Value Controls use the pivot variable of a single column value. The events which are returned can be filtered by the time range and any filters that we set in the control panel for the Filter.

The only exception for visualizations of a single value is that we can not specify an alternative label for the selected field.

The Value controls include three additional fields for single-value visualizations and those typical of the column value element type. All are optional.

Before Label supplies the text of the Label to be displayed before the value.

After Label supplies the text of the Label to show after the value.

Under Label the Label is given to show the value below.

Gauge visualization controls

Visualizations of different gages (radial, marker, and filler) use the value returned by a single-row table with only one column value pivot element to determine where the gage indicator is at any given time. We can set the ranges and colors of the gauge (see the section on the control panel for value, below).

Use the controls Time Range and Filter to filter the results returned by the pivot element of a single column value, as appropriate.

Value

The Value Controls use the pivot variable of a single column value. The event's returns can be filtered by the time range and any filters that we set in the control panel for the Filter.

The only exception for visualizations of a single value is that we can not specify an alternative label for the selected field.

The Value controls also include a Color Ranges fieldset for gage visualizations, which allows us to describe the ranges and colors represented on the gage. The default setting includes three ranges covering the span from 1 to 100 and being respectively colored green, yellow, and red. We can adjust the numeric ranges, add ranges, and update the colors shown for each range as necessary for the values returned by the element of a column value that power the visualization.