Skip to main content
Sumo Logic

Column Charts

Column charts are useful for visually comparing the number of events that have occurred, such as the type of error that occurs the most in your system. To create a Column chart, use a search query that provides at least a few data points in the Aggregates tab.

For example, you could use the following query to create a simple column chart:

(error OR fail*) AND exception | count by _sourceCategory | sort by _count

which would produce results such as:

AggResult.png

Create a column chart

To add a panel with a column chart:

  1. Create or open a Dashboard (New) and click on Add Panel > Time Series or Add Panel > Categorical.
    time series or categorical.png
  2. Provide a Metric or Log query and press Enter for it to run.

    You can create Log and Metric queries on the same panel.

    Log query

    Enter your aggregate search query in the input field and press enter. Only search results that have been aggregated using a group or aggregate operator can be charted. See Group or Aggregate Operators for a list. By default, the query builder is set to Logs.

    Add log query.png

    Metrics query

    Click the left-most dropdown option and select Metrics. You should be familiar with the basics of creating metrics queries and alerts to ensure successful results. By default, the query builder is set to Logs.

    Metrics selection for query builder.png

    To create a metrics query utilize the Metrics Explorer.

    Multiple queries

    To add another query to a panel click the plus + icon on the last query row. Each query is assigned a letter for reference.

    add query.png

  3. Once the query runs you’ll need to flip the chart type to Column.
    new column chart.png
  4. Modify the chart as desired.
  5. Click the Add to Dashboard button on the top right of the window to add the panel to your dashboard.
    Add to Dashboard button.png

Create a stacked column chart

To create a stacked column chart, use a query that uses a multiple series that counts by at least two things, for example, this query from the Sumo Logic App for Apache creates a stacked column chart for visits by country over time:

_sourceCategory=Apache/Access
| parse regex "(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| lookup latitude, longitude, country_code, country_name, region, city, postal_code from geo://location on ip = client_ip
| where !isNull(country_name) AND country_name !=""
| timeslice 5m
| count by _timeslice, country_name
| transpose row _timeslice column country_name as *

When your query is added to the panel builder press Enter to run it. In the Display options pane select a Stacked Display type.

stacked column chart and setting.png