Archive
Highlighted

Annotation of graph not working when i use the below command.

Explorer

Hi all. I'm facing some issues in displaying annotations for my graphs. I suspect that something is wrong when I use 2 STREAMSTATS command. My annotation for that particular graph seems to stop working.

When I run this code, it works!

index="alarm"
| streamstats avg(alarmcount) as average stdev(alarmcount) as standev

| eval threeSigmaLimit = (average + (standev * 3))
| where alarmcount > threeSigmaLimit | eval annotationlabel = index | eval annotationcolor = "0xff9900"
| table time annotationlabel alarmcount

$field1.earliest$
$field1.latest$

However, when I run this code. The annotation disappears.

index="alarm"
| streamstats window=2 min(alarmcount3) as minimum
| eval isincrease=if(alarmcount3!=minimum,1,0)
| streamstats window=7 sum(is
increase) as increases
| where increases>=7
| eval increaseindex = index2 - 6
| eval annotation
label = increaseindex| eval annotationcolor = "0xff9900"
| table time annotationlabel alarmcount3

$field1.earliest$
$field1.latest$

any idea whY??

Tags (1)
0 Karma
Highlighted

Re: Annotation of graph not working when i use the below command.

Contributor

Hi,
When you run the 2nd search do you get any output or only annotation disappears?

0 Karma
Highlighted

Re: Annotation of graph not working when i use the below command.

Explorer

Hi, I get the output but not the annotation. I'm suspecting the 'double' streamstats command is affecting it.

alt text

0 Karma
Highlighted

Re: Annotation of graph not working when i use the below command.

Contributor

Hi,
Don't run your search completely but try running it part by part so that you can find which part of your search is going wrong.

0 Karma
Highlighted

Re: Annotation of graph not working when i use the below command.

Explorer

Yup! I did. I realised that if I remove the '2nd' streamstats command, everything works. Hmmm... I really think that it isn't the code that has a problem here..

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.