Dashboards & Visualizations

Annotations not showing up in my visualization?

iyersudh
Explorer

I have just started using Dashboard Studio and was trying to use annotation on a timechart.

My timechart is driven by a primary search on index=A. Its X-axis is (ofcourse) _time. 

As annotation to it, I want to source values from another search  from index=B.  However, I don't seem to be able to see annotations on it when the dashboard runs. 

Where am I going wrong? I have pasted the primary search and annotation search below

  

 

 

		"ds_6Ze3CeYO": {
			"type": "ds.search",
			"options": {
				"query": "index=sdc_offset source=\"/var/lib/sdc/runInfo/DAY*\"\n| eval pipeline_source = DAY\n| eval lag=_indextime-EpochTime \n| timechart span=5m max(lag) as lag(s)",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Base Search - Day latency timechart"
		},
		"ds_eod_search": {
			"type": "ds.search",
			"options": {
				"query": "index=eodbatch \n| bin _time span=1m\n| fields _time JobName \n| eval annotation_label=case(JobName=\"first_event\",\"Batch Started here\",JobName=\"last_event\",\"Batch Ended here\")",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Annotation"
		},

 

 

Labels (2)
0 Karma

JB888
Engager

I'm also struggling with this. I've followed Splunk's example, even naming all my fields the same but with zero success. 

https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/dsSec#Annotation_example

Their documents also conflict on where the annotation options should go. In the example, its in a "encoding" stanza, in their Dashboard Studio docs, suggests they below in "options"

Tried both, no annotations. Sorry I have no help but thought maybe you hadn't added seen the requirement for the options. 

 

 

0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...