Once you've selected either a full table or custom SQL query, you can create data visualizations using dimensions and measures derived from the table's metadata. This section describes how to use visualizations to display insights that have been discovered in the data.

Creating and Working with Data Visualizations

When you connect to a Splunk table or query, a series of dimensions (qualitative data) and measures (quantitative data) will be dynamically discovered from its metadata.

The following example shows how to create and work with data visualizations, using a bar chart as an example. See Data Model for more specifics on querying Splunk tables.

1. Find the Marks window (between the Data pane and the sheet display area). Select Bar in the dropdown.
2. Select a dimension from the Dimensions section in the Data pane. Right-click + drag the dimension into the Columns section above the sheet.
3. Select a measure from the Measures section in the Data pane. Right-click + drag the measure into the Rows section above the sheet.

You should now see that a bar chart has been constructed with each dimension as an independent bar. The size of each bar will be determined by the size of the associated measure from the imported data.