splunk | charting rules
TRANSCRIPT
![Page 1: Splunk | Charting Rules](https://reader036.vdocuments.site/reader036/viewer/2022082620/5491ad3cb479594d2d8b48cf/html5/thumbnails/1.jpg)
REPORT TYPE SUB TYPE CHART TYPE OPTIONSTrend over time Single Series Line (default) Null Values, Time Range Binning
Area Null Values, , Time Range BinningColumn Time Range BinningTable Only No scale, Time Range Binning
Split Series Line (default) Stack Mode, Null Values, line display marker, Time Range BinningArea Stack Mode, Null Values, Time Range BinningColumn Stack Mode, Time Range BinningTable Only No scale, Time Range Binning
Multiple Series Line (default) Null Values, line display marker, Time Range BinningColumn Time Range BinningTable Only No scale, Time Range Binning
Top Values Time Range BinningTable Only No scale, Time Range Binning
Distribution Top Values Bar (default)Pie # Cat to show before bucketing into "other", No scaleTable Only No scale
Rare Values Table OnlyContingency Tabl Table Only
Heat Map
Correlation N/A Scatter (default)Null Values - omit only, Scale options for x & y axisColumnTable Only
Function /Aggregator Menu Null ValuesShow: Only applies to line and area chart types
Count of Events Options:Count Omit (default)Distinct Count Connect
Treat as '0'summin Stack Mode Optionsmax If 100% Stacked, no scale optionsaverage / mean Options:median Stacked (default)mode 100% stackedvariance - sample Not stackedvariance - populationstandard deviation - sample Scalestandard deviation - population linear (default)percentile (1-99) > logarithmicfirstlastrange
Column (default)
Numerical (values forced for categorical fields)
![Page 2: Splunk | Charting Rules](https://reader036.vdocuments.site/reader036/viewer/2022082620/5491ad3cb479594d2d8b48cf/html5/thumbnails/2.jpg)
Stack Mode, Null Values, line display marker, Time Range Binning