Scatter charts display two independent numeric fields allowing you to see any correlation between them. You can visually determine how your fields relate to and affect one another.
The aggregate field is displayed as a collection of points. Each point requires two numerical fields for the X and Y axes.
- The X dimension must be numeric and is displayed against the X axis of the scatter chart.
- The Y dimension must be numeric and is displayed against the Y axis of the scatter chart.
For example, in the following query
logins is the aggregate field and will be displayed as data points. The fields
longitude can be used as dimensions.
_sourceCategory=service "message=User logged in" remote_ip
| parse "[remote_ip=*]" as remote_ip
| lookup latitude, longitude, city, state from geo://location on ip = remote_ip
| count as logins by city, latitude, longitude
Create a scatter chart
To add a panel with a scatter chart:
- Create or open a Dashboard (New) and click on Add Panel > Categorical.
- Provide a Log query and press Enter for it to run.
- Once the query runs you’ll need to flip the chart type to Scatter.
- Modify the chart as desired.
- Click the Add to Dashboard button on the top right of the window to add the panel to your dashboard.