Add and format visualizations

You can use the editing bar to add objects to your dashboard and the Configuration panel in the visual editor to use most formatting options for visualizations. At most, a visualization displays the first 10,000 search results.

  1. Select a chart or other visualization by clicking one of the visualization options in the editing toolbar. For example, to add a chart, click the Add Chart button ( The Add chart button in the editing toolbar. ) and select a chart.
  2. Set up a data source by adding a new search or selecting an existing data source by doing one of the following:
    • In the Search, Saved search, or Chain search section of the Select data source panel, select + Create search.
    • To select an existing data source, choose a search from those listed in the Search, Saved search, or Chain search sections of the Select data source panel.
    • Select + Set up primary data source if you've selected a shape, then create a new search or select an existing one.
  3. If creating a new search, do the following:
    • If creating a new search, name your data source in the Data source name field. Add your search to the SPL query field.

    • If creating a new saved search, search for and select the desired saved search.

    • If creating a new chain search, select the desired parent search, then add your search to the SPL query field.

  4. Select Apply and close.

To customize your visualization, use the available options in the Configuration panel below the Data sources section.

For further customization, under Source code in the Configuration panel, use dynamic options syntax (DOS) to add dynamic visualizations to your chart. See Dynamic options in Dashboard Studio.

To learn about data sources, see Create search-based visualizations with ds.search.

Optimize the rendering of high density charts

If a chart has more data points than its width can display, you can reduce the number of data points to match the visualization width. Additionally, you can expand the width of a chart to render more data points. You can also open the visualization in Search to render all data points.

For visualizations where optimized rendering is available, Dashboard Studio enables it by default. The following visualizations with a time-series x-axis or an increasing numeric x-axis support optimized rendering:

  • Area chart
  • Column chart
  • line chart

The following steps turn on the option to optimize rendering:

  1. Select the canvas of your dashboard.
  2. Navigate to the Configuration panel and find the View Options section.
  3. Check that the Optimized rendering option is toggled on. If the option is toggled off and you toggle it on, you must save and reload your dashboard for the changes to take effect. If the option is unavailable, verify that the activate_downsampling feature flag is set to "true" in your web-features.conf file.

The Largest-Triangle-Three-Buckets algorithm optimizes the charts and aims to preserve the chart's shape, including its outliers, as accurately as possible, though it might not achieve perfect preservation. For instance, when outliers cluster, some data points may not display, potentially altering the chart's appearance. A clustering example would be having the first data point at 1000, the second at 0, and the third at 2000. If there are 3 times more points than the width of the chart, only 1 data point displays from the data points available.

The algorithm does not run if a chart contains a column that mixes null values with numbers or combines strings and numbers. Instead, the chart displays all data points.

Round visualization corners

To round the corners of your visualization, do the following steps:

  1. Select your visualization. A highlighted blue border confirms you've selected the visualization.
  2. Navigate to the Configuration panel and find the Color and style section.
  3. Select Independent corner radius or specify a value for Corner radius. Independent corner radius provides the option to change each corner separately in the visualization. Corner radius changes all corners to the same value.

The following image shows the difference between a column chart with and without rounded corners.

2 column charts side by side. The left chart has rounded corners. The right chart has corners at a 90 degree angle.

Migrate to the splunk.<type>syntax

The splunk.<type> syntax is required for adding tokens and drilldowns in dashboards, and supports dynamic options syntax. If your visualizations still use the viz.<type> syntax, you can migrate from viz.<type> to splunk.<type> when your dashboard refreshes. At the beginning of each reload, a banner prompts you to migrate with one click.

You can check the type of your visualizations in the Code section of the visualization's Configuration panel or in the source editor. The following is an example of a visualization stanza for a column chart using the splunk.<type> syntax.

JSON 
"visualizations": {
    "viz_KabMOTyq": {
        "type": "splunk.column",
         "dataSources": {
             "primary": "ds_c8AfQapt"
         },
         "title": "HTTP Request Methods"
     }
},

Change a visualization type

If your data is formatted correctly, you can change one visualization into another by performing the following steps:

  1. In the visual editor, select the visualization that you would like to change.
  2. Open the Configuration panel.
  3. Use the General dropdown menu to select the new visualization.