topic Re: How do I enable mouse hover feature in Dashboard Studio? in Dashboards & Visualizations

How do I enable mouse hover feature in Dashboard Studio?

TrangCIC81 — Tue, 19 Dec 2023 06:34:23 GMT

Hello,

How can I enable mouse hover feature on column chart to show its data in Dashboard Studio? I have been searching for an answer but haven't found anything work.

Many thanks,

index=web AND uri_path!="*.nsf*" AND uri_path!="*:443" | timechart span=1d dc(src_ip) by src_ip limit=0

Re: How do I enable mouse hover feature in Dashboard Studio?

ITWhisperer — Tue, 19 Dec 2023 08:23:28 GMT

It already has mouse hover, at least in the version I am using. Which version of Splunk are you using?

Re: How do I enable mouse hover feature in Dashboard Studio?

TrangCIC81 — Tue, 19 Dec 2023 08:43:02 GMT

Splunk Enterprise 9.0.4

It does not show when I mouse hover

Re: How do I enable mouse hover feature in Dashboard Studio?

TrangCIC81 — Tue, 19 Dec 2023 08:46:43 GMT

Ohh I know it is weird but it did not show for the whole time until just now I tried to mouse hover again and it came out. I guess it is because of a long delay in display? Thank you by the way.

Re: How do I enable mouse hover feature in Dashboard Studio?

TrangCIC81 — Tue, 19 Dec 2023 09:01:54 GMT

I just got the reason why it did not show mouse hover.
The "View" option makes it work but I had been viewing it in the edit view. Very confusing!

Re: How do I enable mouse hover feature in Dashboard Studio?

ITWhisperer — Tue, 19 Dec 2023 09:07:45 GMT

Yes, it doesn't work in edit mode (which is not surprising!)

Re: How do I enable mouse hover feature in Dashboard Studio?

TrangCIC81 — Tue, 19 Dec 2023 09:25:52 GMT

Btw, I have created the same search but in classic dashboard. It shows the results with this warning.

"These results may be truncated. Your search generated too much data for the current visualization configuration. "
and it is indeed truncating the number of results.

I have been trying to change the default setting of the "charting.chart.resultTruncationLimit" and "charting.data.count" property (added them in the search query) but it does not increase the number of data. Is there anyway to make it show all the data in the classic dashboard?

https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartDisplayissues?ref=hk#Search_result_truncation

<option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.resultTruncationLimit">500000</option> <option name="charting.data.count">100000</option> <option name="charting.drilldown">none</option>