All Apps and Add-ons

Displaying two visualizations in one dashboard panel

Contributor

All,

I have a dashboard panel that I want to display two visualizations on. The first is a stacked area graph that displays the amount of time spent processing in browser vs network vs server. The second is a line chart that just has the count of events over that same timespan. I posted an image below for your convenience.

alt text

Hopefully that didn't get cut off, but in case it did, the purple area is actually the count of events over that time range. I want the blue, yellow, and red areas to display as-is, but the purple area should be a separate line graph.

It would be ideal if the count had it's own separate axes on the right, but in this case the scales are about the same for each visualization, so that's not required. I've read up enough to know this is possible, but I can't find the details to get it to work. Any help wold be greatly appreciated.

Thanks!

1 Solution

Splunk Employee
Splunk Employee

Splunk 6 no longer supports the FlashCharts library in Simple XML, which is what was used to generate these chart overlays. This is also the reason why some of your "charting.*" options do not work, as they are specific to FlashCharts, and including them in your XML would previously trigger Splunk to invoke FlashCharts as the rendering engine for that chart.

As a temporary workaround, Advanced XML still supports FlashCharts, and can be used for this use case.

View solution in original post

Splunk Employee
Splunk Employee

Splunk 6 no longer supports the FlashCharts library in Simple XML, which is what was used to generate these chart overlays. This is also the reason why some of your "charting.*" options do not work, as they are specific to FlashCharts, and including them in your XML would previously trigger Splunk to invoke FlashCharts as the rendering engine for that chart.

As a temporary workaround, Advanced XML still supports FlashCharts, and can be used for this use case.

View solution in original post

Splunk Employee
Splunk Employee

Correct, Splunk 6.1 now supports Chart Overlay in both Simple XML and the UI Viz Editor. In short, you can take a column/area/line chart, and add an overlay by setting:
- field(s) that you want to use in the overlay
- Single or dual y-axis
- If dual y-axis, then you have several axis label/scale.min/max settings

0 Karma

Contributor

Sounds like this might be included in the 6.1 release. Can you confirm?

0 Karma

Contributor

Can you link me to documentation on Advanced XML vs Simple XML? Thanks for the answer!

0 Karma

SplunkTrust
SplunkTrust

Basically you want to show two charts in one visualization. There are many such problem discussed before in this forum. Here are some of them which might be helpful.

Example 1

Example 2

Example 3

Contributor

I've actually been to all of these pages. In fact, Example 3 is exactly the template I have been using. The search I am doing looks exactly like the search from that example. However, when I alter the simple XML, Splunk only respects the first chart's display type and doesn't respect any of the "charting.*.columns" properties. In other words, it just tries to apply the first charts display to all returned columns.

Does timespan mess up chart overlays? Is chart overlay not respected in Splunk 6? Any insight would be appreciated.

0 Karma