Skip to main content
Sumo Logic

Bubble Charts

Bubble charts display three dimensions of data. A bubble chart is a two dimensional scatter chart where each data point is represented by its size, the third dimension. This allows you to visualize the counts associated with each point. Bubble charts require at least one aggregate dimension and two other numeric dimensions.

  • The X dimension must be numeric and is displayed against the X axis of the bubble chart.
  • The Y dimension must be numeric and is displayed against the Y axis of the bubble chart.
  • The Z dimension is normally the aggregate field and shows the value of each bubble.

For example, in the following query logins is the Z dimension and will be displayed as the value of each bubble. The fields latitude and longitude can be used as dimensions.

_sourceCategory=service "message=User logged in" remote_ip
| parse "[remote_ip=*]" as remote_ip
| lookup latitude, longitude, city, state from geo://location on ip = remote_ip
| count as logins by city, latitude, longitude

Create a bubble chart

To add a panel with a bubble chart:

  1. Create or open a Dashboard (New) and click on Add Panel > Categorical.
    categorical.png
  2. Provide a Log query and press Enter for it to run.

    Log query

    Enter your aggregate search query in the input field and press enter. Only search results that have been aggregated using a group or aggregate operator can be charted. See Group or Aggregate Operators for a list.

    Add log query.png

  3. Once the query runs you’ll need to flip the chart type to Bubble. A bubble chart requires three dimensions, including the aggregate.
    bubble chart.png
  4. Modify the chart as desired.
  5. Click the Add to Dashboard button on the top right of the window to add the panel to your dashboard.
    Add to Dashboard button.png