topic Re: Chart overlay graphs not in sync in Splunk Search

Chart overlay graphs not in sync

Norling80 — Tue, 26 May 2015 09:21:25 GMT

Hey guys, does anyone of you know why this happens when on dashboard with chart overlay elements? I only experience it when I look at charts over 1 week of time.

Re: Chart overlay graphs not in sync

MichaelPriest — Tue, 26 May 2015 10:15:32 GMT

Have you got an example of the search or data?

Re: Chart overlay graphs not in sync

Norling80 — Wed, 27 May 2015 06:21:50 GMT

Here you go

index=main sourcetype="playerdata" | timechart span=1h dc(PlayerId) | appendcols [search index=main sourcetype="playerdata" ActionTaken=observe | timechart span=1h dc(PlayerId)]

Re: Chart overlay graphs not in sync

Arun_N_007 — Wed, 27 May 2015 07:37:21 GMT

Hi,

Could you please have a look into the table which generated this graph?

Check whether the values are in sync??

Re: Chart overlay graphs not in sync

intelsubham — Wed, 27 May 2015 11:27:36 GMT

It is possible that when you are running the search for longer duration, values for some rows in one of the searches is null which is resulting in gap.
try to include fillnull at the end of both searches and run again.

Re: Chart overlay graphs not in sync

chimell — Wed, 27 May 2015 16:18:26 GMT

Hi Norling80
Just copy and test this dashboard xml code

<dashboard>
  <label>dashboard_name</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=main sourcetype="playerdata" | timechart span=1h dc(PlayerId) | appendcols [search index=main sourcetype="playerdata" ActionTaken=observe | timechart span=1h dc(PlayerId)]</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">dc_with_all_ActionTaken</option>
        <option name="charting.axisTitleY.text">dc_with_one_ActionTaken</option>
      </chart>
    </panel>
  </row>
</dashboard>

Re: Chart overlay graphs not in sync

Norling80 — Mon, 01 Jun 2015 14:00:16 GMT

I still have the same problem, at this point it seems to be a problem with the timestamp, I will look into it and update this thread.