- Splunk Operational Intelligence Cookbook
- Josh Diakun Paul R Johnson Derek Mock
- 247字
- 2025-04-04 16:53:03
Enriching data with visualizations
Data on its own can be hard for us, as humans, to make sense of easily and can be extremely tedious to analyze. Visualizations provide a powerful way to bring data to life. Presenting data in a visual context enables those viewing it to better understand the relationship one value has to another, identify patterns, build correlations between datasets, and plot trends. Colors that we easily relate to can be applied to visualizations in order to direct attention and highlight specific data points. For example, a value being within an acceptable range might be colored green, but when this value increases, it might change to yellow and eventually to red when it's within an unacceptable range. Humans associate red with bad and green with good; therefore, a red value nicely conveys the need for attention.
Let's now apply this to an Operational Intelligence example. Imagine that you have a distributed environment of web servers that are generating large amounts of erratic data. Inside each of these events is a field that represents the response time of when that event occurred. If you were left having to analyze these events row by row in a table, it could take a very long time to find the events with values outside of the norm. Using visualizations such as a scatter chart, you could plot your event data and easily be able to identify these discrete events that lie outside of the primary cluster of events.