Dashboards & Visualizations

Annotations not showing up in my visualization?

iyersudh
Explorer

I have just started using Dashboard Studio and was trying to use annotation on a timechart.

My timechart is driven by a primary search on index=A. Its X-axis is (ofcourse) _time. 

As annotation to it, I want to source values from another search  from index=B.  However, I don't seem to be able to see annotations on it when the dashboard runs. 

Where am I going wrong? I have pasted the primary search and annotation search below

  

 

 

		"ds_6Ze3CeYO": {
			"type": "ds.search",
			"options": {
				"query": "index=sdc_offset source=\"/var/lib/sdc/runInfo/DAY*\"\n| eval pipeline_source = DAY\n| eval lag=_indextime-EpochTime \n| timechart span=5m max(lag) as lag(s)",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Base Search - Day latency timechart"
		},
		"ds_eod_search": {
			"type": "ds.search",
			"options": {
				"query": "index=eodbatch \n| bin _time span=1m\n| fields _time JobName \n| eval annotation_label=case(JobName=\"first_event\",\"Batch Started here\",JobName=\"last_event\",\"Batch Ended here\")",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Annotation"
		},

 

 

Labels (2)
0 Karma

JB888
Engager

I'm also struggling with this. I've followed Splunk's example, even naming all my fields the same but with zero success. 

https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/dsSec#Annotation_example

Their documents also conflict on where the annotation options should go. In the example, its in a "encoding" stanza, in their Dashboard Studio docs, suggests they below in "options"

Tried both, no annotations. Sorry I have no help but thought maybe you hadn't added seen the requirement for the options. 

 

 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...