topic Re: How to make a chart overlay in Splunk Search

How to make a chart overlay

vino06 — Thu, 25 May 2017 06:57:37 GMT

I'm trying to make a graph using a chart overlay, scenario is I want to put all the transactions with minutes to the left and right for all transactions that are in count. Please see my search below and the graph.

index="appdynamics" source="metrics.log" sourcetype="metrics" name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:VerySlowCalls OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:CallsPerMin OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:ErrorsPerMin OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:StallCount OR name=RDYWPD01:TomcatA:PortalProd:AveResponseTime
| timechart span=1d avg(value) by name
| rename RDYWPD01-TomcatA:ServiceProxy:PortalProd:VerySlowCalls as "Very Slow Calls", RDYWPD01-TomcatA:ServiceProxy:PortalProd:CallsPerMin as "Calls per minute", RDYWPD01-TomcatA:ServiceProxy:PortalProd:ErrorsPerMin as "Error per minute", RDYWPD01-TomcatA:ServiceProxy:PortalProd:StallCount as "Stall Counts", RDYWPD01:TomcatA:PortalProd:AveResponseTime as "Average Response Time (ms)"][1]

Re: How to make a chart overlay

kamlesh_vaghela — Thu, 25 May 2017 11:37:53 GMT

HI @vino06,
First, create overlay field in the search.

//for example if overlay=100

YOUR SEARCH | eval overlay=100

Second, add charting.chart.overlayFields option in chart xml.

<option name="charting.chart.overlayFields">overlay</option>

I hope it's helpful to you.

Thanks

Re: How to make a chart overlay

niketn — Thu, 25 May 2017 11:54:05 GMT

@vino06... While you want to overlay Time fields over Count fields, your time fields are both in minute and millisecons. Based on the output, you might have to change the unit.

    <option name="charting.axisTitleY.text">Count</option>
    <option name="charting.axisTitleY2.text">Time</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.overlayFields">"Calls per minute", "Error per minute","Average Response Time (ms)"</option>
    <option name="charting.chart.nullValueMode">zero</option>

PS: Based on the screenshot, you also might want to set the Null Value Mode to zero or connected which is currently gap. All these settings are directly accessible fromEdit > Format visualization in UI (if you want to avoid changing via Simple XML)

Re: How to make a chart overlay

cmerriman — Thu, 25 May 2017 12:06:34 GMT

this question was asked earlier. https://answers.splunk.com/answers/542628/chart-overlay-1.html for reference.