After Connecting to Data, you can create data visualizations in the Report view by dragging fields from the Fields pane onto the canvas. This section describes how to use visualizations to display insights that have been discovered in the data.

Creating and Working with Data Visualizations

The following example shows how to create and work with data visualizations, using a pie chart as an example. For more specifics on querying Splunk tables, see Data Model.

1. Select a pie chart icon in the Visualizations pane.
2. Select a dimension in the Fields pane.
3. Select a measure in the Fields pane.

To display options to select the sort column and change the sort order, click the chart's ellipsis (...) button.

Highlighting and Filtering Data

Highlighting and filtering change the focus on the data. Filtering removes unfocused data from visualizations; highlighting does not remove data, but instead highlights a subset of the visible data. The unhighlighted data remains visible, but dimmed.

To highlight a field, click it. You can apply filters at the page level or at the report level. To create a filter, drag fields onto the Filters pane. Select the filter type and filter options in the Filters pane.

Creating Real-Time Visualizations

If you selected DirectQuery data connectivity mode when you created the connection, the connector builds a new SELECT WHERE clause as you change the filter.