This search tracks sourcetype frequency over time.The stats, chart, and timechart commands are great commands to know (especially stats). (Optional) Use the Format menu to configure the visualization.Select the Visualization tab and use the Visualization Picker to select the line or area chart visualization.The statistics table here should have two or more columns. Select the Statistics tab below the search bar.If you are building a line chart you can opt to generate a single data series. Write a search that generates multiple data series.Review the following details about building column and bar charts. Use stacked 100% to focus on data distributions. The chart shows distribution percentage for each series over the whole data set. Use a stacked area chart to highlight the relative volume, frequency, or importance of a series. As the number of series increases, the chart can become more difficult to understand. Review the comparison table here to select a stacking option.Īreas for different series share the same space on the chart.Īn unstacked chart is useful for a lower number of series. Use a stacked area chart to see more details about a series and how it relates to the entire data set. Stacking is not available for line charts. Stacked area charts are available when a search generates multiple data series. Enable the mode to show independent axis ranges for each series. If the chart represents multiple data series, you can also configure the following options.Ĭompare trends across multiple series. Chart legend position and label truncation.Only y-axis values can be abbreviated in area and line charts. For example, a value of 20,000 will be abbreviated to 20K if you toggle this option to On. Specify whether to abbreviate y-axis numerical values.This option is helpful when there is a wide range in y-axis values. Use a logarithmic unit scale for y-axis values.Show minimum and maximum y-axis values.Connect to the next positive data point.Connect null data points to zero data points.The chart shows markers for any disconnected data points in this case. Use the Format menu to configure one or more of the following line and area chart components. Each clientip is a data series with its own avg(bytes) values for each source. The split-by field produces multiple data series. | chart avg(bytes) over source by clientip In this search, the over operator indicates that source is the first table column. Line charts can also be used for a single data series, but area charts cannot.Ī search compares the average number of bytes passed through each source. Typically, line or area charts represent multiple series. For example, using the eval or fields commands might change search result structure. Search results not structured as a table with valid x-axis or y-axis values cannot generate line or area charts. A line or area chart generated with this search has a _time x-axis. The next table columns contain y-axis values.Īs an example, any search using the timechart reporting command generates a table where _time is the first column. Line and area charts get x-axis values from the first column in the Statistics table. The Statistics table should have at least two columns for a single series, and three or more columns for multiple series. To make sure that a search generates data series correctly, check the Statistics tab below the search bar. If a search generates multiple series, each line or area in the chart appears in a different color. Area charts represent multiple data series. Line charts can represent one or more data series. You can also use a line or area chart x-axis to represent a field value other than time. Use line and area charts to track value trends over time.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |