Dashboards & Visualizations

Annotations not showing up in my visualization?

iyersudh
Explorer

I have just started using Dashboard Studio and was trying to use annotation on a timechart.

My timechart is driven by a primary search on index=A. Its X-axis is (ofcourse) _time. 

As annotation to it, I want to source values from another search  from index=B.  However, I don't seem to be able to see annotations on it when the dashboard runs. 

Where am I going wrong? I have pasted the primary search and annotation search below

  

 

 

		"ds_6Ze3CeYO": {
			"type": "ds.search",
			"options": {
				"query": "index=sdc_offset source=\"/var/lib/sdc/runInfo/DAY*\"\n| eval pipeline_source = DAY\n| eval lag=_indextime-EpochTime \n| timechart span=5m max(lag) as lag(s)",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Base Search - Day latency timechart"
		},
		"ds_eod_search": {
			"type": "ds.search",
			"options": {
				"query": "index=eodbatch \n| bin _time span=1m\n| fields _time JobName \n| eval annotation_label=case(JobName=\"first_event\",\"Batch Started here\",JobName=\"last_event\",\"Batch Ended here\")",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Annotation"
		},

 

 

Labels (2)
0 Karma

JB888
Engager

I'm also struggling with this. I've followed Splunk's example, even naming all my fields the same but with zero success. 

https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/dsSec#Annotation_example

Their documents also conflict on where the annotation options should go. In the example, its in a "encoding" stanza, in their Dashboard Studio docs, suggests they below in "options"

Tried both, no annotations. Sorry I have no help but thought maybe you hadn't added seen the requirement for the options. 

 

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...