| Latest single number, big and bold | singlevalue | one numeric field | Not markergauge: gauge implies a threshold context |
| Latest number + status icon (pass/fail/warn) | singlevalueicon | numeric + status string | Not singlevalue alone: numeric requires manual threshold reading |
| Single number on a radial dial | singlevalueradial | numeric + min + max | Not markergauge: radial is decorative; gauge is functional |
| Trend over time, 1–6 series | line | _time + value(s) per series | Not column: column implies discrete categories, not continuous time |
| Trend with stacked composition | area (stacked) | _time + multiple series | Not line: stacked area shows part-of-whole evolving over time |
| Compare discrete categories, vertical bars | column | category + numeric | Not bar: column is for short labels and time-on-X |
| Compare categories, long category labels | bar (horizontal) | category + numeric | Not column: long x-axis labels rotate and become unreadable |
| Part-of-whole, ≤5 slices | pie | category + numeric | With > 5 slices use bar — slices become unreadable |
| Tabular data with per-row formatting / drilldown | table | any | Not chart: exact values + drilldown require table |
| Geographic distribution with point markers / bubbles | map | lat + lon (+ optional value) | Not choropleth: map plots individual points; choropleth fills regions |
| Geographic distribution by country / US state on a real map | map (with choropleth layer) | region code + value, plus geom geo_countries / geom geo_us_states in SPL | In Studio, country / state shading is a layer inside splunk.map — there is no splunk.choropleth.map viz type |
| Custom-region shading (floor plan, schematic, non-political polygons) | choropleth-svg | region id + value, plus an SVG with matching path ids | Not map: there is no Leaflet basemap for custom geometry — SVG is the escape hatch |
| Flow between stages (funnel, attribution, network paths) | sankey | source + target + value | Not stacked bar: Sankey shows path, stacked bar shows totals |
| Metric vs threshold, headroom matters | markergauge | numeric + thresholds | Not singlevalue: marker shows distance to threshold |
| 0–100 % progress / capacity fullness | fillergauge | numeric (0–100) | Not markergauge: filler implies a continuum, marker implies a target |
| Activity by hour-of-day × day-of-week | punchcard | hour + weekday + count | Not heatmap-as-table: punchcard reveals temporal pattern |
| Network / dependency graph | linkgraph | source + target (+ value) | Not sankey: linkgraph shows topology, sankey shows flow |
| Multi-dimensional comparison (>2 numeric axes) | parallelcoordinates | several numeric fields per row | Not scatter: scatter handles 2 dims, parallel coords handles many |
| Correlation between two measures | scatter | two numeric fields | Not line: line implies an order, scatter does not |
| Three-variable correlation (x, y, volume) | bubble | three numeric fields | Not scatter: bubble encodes magnitude in radius |
| Discrete events on a timeline (incidents, deploys) | timeline | _time + event label | Not line: line is for continuous metrics, timeline for categorical events |
| Raw event stream | events | _raw | Not table: events preserves the original event view |
| Section header / instructions / static prose | markdown | none | Not table: text content is not data |
| Logo / static image | image | none (static URL) | Not markdown: markdown cannot embed arbitrary images |
| Visual grouping, card background, depth layer | rectangle | none | Layer behind viz panels for depth and grouping |
| Decorative dot, status indicator, legend swatch | ellipse | none | Use sparingly — most uses are better as a labeled singlevalueicon |
