topic Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts? in Splunk Search

Is there any way to overlay vertical lines for event marking in Splunk timecharts?

aramirez_evolut — Mon, 22 Jun 2015 14:24:15 GMT

Tools such as graphite allow for the concept of "infinity" in charts in order to display vertical lines to be overlayed on charts. These are typically used for marking single events over a continuous sequence, e.g. deployment of new build version to a web server. This allows for users to quickly see how a single type or class of event has caused an inflection in the timechart.

Is there any way to accomplish this same visualization with Splunk timecharts? I find this to be an invaluable feature on other systems and would love for it to be added to Splunk timecharts, if not there already for comparable reporting and analysis.

Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts?

diogofgm — Mon, 22 Jun 2015 15:45:26 GMT

You can probably achieve something like that if you do a timechart with the code deploy (e.g. Number of changes for that build) as bars and the warnings as a chart overlay. Doing it like this you would get more information than just with the vertical lines, since you could relate the errors to the amount of changes made to the last build.

Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts?

aramirez_evolut — Wed, 24 Jun 2015 17:55:18 GMT

Number of changes in a deployment seems to be a vanity metric, since it doesn't really speak to how profound a change is. Deployments were just one example of a single event with no relevant quantifiable data points to plot on the timechart. Other examples could be things like restarting servers, human workflow CRM steps (email or call sent), or start/end of a promotional campaign. Each of those examples could be pit against other logs with server, application, or KPI data for a holistic report or dashboard.

Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts?

diogofgm — Thu, 25 Jun 2015 21:50:07 GMT

Sure, it was just an example on how the vertical lines could be achieved.

Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts?

lizi_zhu — Tue, 29 Dec 2015 21:55:04 GMT

I need exactly same function to help visualize release impact on metrics. Do we have any update on this thread?

Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts?

hylam — Wed, 30 Dec 2015 09:16:34 GMT

You can use javascript/jquery/selector to locate the DOM/SVG object for "16:00", get its x-coordinate, then draw a vertical line using SVG.

Another way would be putting a transparent redVerticalLine.png over the chart.

Re: Is there any way to overlay vertical lines for event marking in Splunk timecharts?

ibob0304 — Mon, 19 Jun 2017 12:49:21 GMT

I downvoted this post because wrong assumption. not easy to implement.