Dashboards & Visualizations

Annotations not showing up in my visualization?

iyersudh
Explorer

I have just started using Dashboard Studio and was trying to use annotation on a timechart.

My timechart is driven by a primary search on index=A. Its X-axis is (ofcourse) _time. 

As annotation to it, I want to source values from another search  from index=B.  However, I don't seem to be able to see annotations on it when the dashboard runs. 

Where am I going wrong? I have pasted the primary search and annotation search below

  

 

 

		"ds_6Ze3CeYO": {
			"type": "ds.search",
			"options": {
				"query": "index=sdc_offset source=\"/var/lib/sdc/runInfo/DAY*\"\n| eval pipeline_source = DAY\n| eval lag=_indextime-EpochTime \n| timechart span=5m max(lag) as lag(s)",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Base Search - Day latency timechart"
		},
		"ds_eod_search": {
			"type": "ds.search",
			"options": {
				"query": "index=eodbatch \n| bin _time span=1m\n| fields _time JobName \n| eval annotation_label=case(JobName=\"first_event\",\"Batch Started here\",JobName=\"last_event\",\"Batch Ended here\")",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Annotation"
		},

 

 

Labels (2)
0 Karma

JB888
Engager

I'm also struggling with this. I've followed Splunk's example, even naming all my fields the same but with zero success. 

https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/dsSec#Annotation_example

Their documents also conflict on where the annotation options should go. In the example, its in a "encoding" stanza, in their Dashboard Studio docs, suggests they below in "options"

Tried both, no annotations. Sorry I have no help but thought maybe you hadn't added seen the requirement for the options. 

 

 

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...