topic Re: Annotation of graph not working when i use the below command. in Dashboards & Visualizations

Annotation of graph not working when i use the below command.

marvinlee93 — Tue, 29 Sep 2020 23:31:50 GMT

Hi all. I'm facing some issues in displaying annotations for my graphs. I suspect that something is wrong when I use 2 STREAMSTATS command. My annotation for that particular graph seems to stop working.

When I run this code, it works!

index="alarm"
| streamstats avg(alarmcount) as average stdev(alarmcount) as standev

| eval threeSigmaLimit = (average + (standev * 3))
| where alarmcount > threeSigmaLimit | eval annotation_label = index | eval annotation_color = "0xff9900"
| table _time annotation_label alarmcount
$field1.earliest$
$field1.latest$

However, when I run this code. The annotation disappears.

any idea whY??

Re: Annotation of graph not working when i use the below command.

nikita_p — Fri, 01 Mar 2019 07:06:47 GMT

Hi,
When you run the 2nd search do you get any output or only annotation disappears?

Re: Annotation of graph not working when i use the below command.

marvinlee93 — Fri, 01 Mar 2019 08:48:57 GMT

Hi, I get the output but not the annotation. I'm suspecting the 'double' streamstats command is affecting it.

Re: Annotation of graph not working when i use the below command.

nikita_p — Fri, 01 Mar 2019 11:11:18 GMT

Hi,
Don't run your search completely but try running it part by part so that you can find which part of your search is going wrong.

Re: Annotation of graph not working when i use the below command.

marvinlee93 — Mon, 04 Mar 2019 01:51:04 GMT

Yup! I did. I realised that if I remove the '2nd' streamstats command, everything works. Hmmm... I really think that it isn't the code that has a problem here..