topic Re: How to specify SplitMode using simple form XML in Splunk Search

How to specify SplitMode using simple form XML

melonman — Wed, 25 Aug 2010 14:16:20 GMT

Hi there,

I can create a line graph with SplitMode, however there is no configuration guide for manually adding XML tag for SplitMode configuration.

Do to this, do I have to use advanced XML instead with simple form XML? Can I do like the following XML to set SplitMode?

sourcetype=resusage | timechart avg(CPU_Per) avg(MEM_Per) avg(DISK_Per) Resource Usage Trend @mon +1mon@mon line split all

Thanks!

gkanapathy — Wed, 25 Aug 2010 21:21:33 GMT

Looks like an omission in the docs, but I think it should be

<option name="charting.layout.splitSeries">true</option>

splits into multiple charts, while false is the default and combines it into one.

melonman — Thu, 26 Aug 2010 07:37:52 GMT

thank you, I would appreciate if you also mention here how to do the same thing using advanced XML.

melonman — Thu, 26 Aug 2010 08:22:56 GMT

I found this working, thanks.

true