I have just started using Dashboard Studio and was trying to use annotation on a timechart.
My timechart is driven by a primary search on index=A. Its X-axis is (ofcourse) _time.
As annotation to it, I want to source values from another search from index=B. However, I don't seem to be able to see annotations on it when the dashboard runs.
Where am I going wrong? I have pasted the primary search and annotation search below
"ds_6Ze3CeYO": {
"type": "ds.search",
"options": {
"query": "index=sdc_offset source=\"/var/lib/sdc/runInfo/DAY*\"\n| eval pipeline_source = DAY\n| eval lag=_indextime-EpochTime \n| timechart span=5m max(lag) as lag(s)",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"name": "Base Search - Day latency timechart"
},
"ds_eod_search": {
"type": "ds.search",
"options": {
"query": "index=eodbatch \n| bin _time span=1m\n| fields _time JobName \n| eval annotation_label=case(JobName=\"first_event\",\"Batch Started here\",JobName=\"last_event\",\"Batch Ended here\")",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"name": "Annotation"
},
I'm also struggling with this. I've followed Splunk's example, even naming all my fields the same but with zero success.
https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/dsSec#Annotation_example
Their documents also conflict on where the annotation options should go. In the example, its in a "encoding" stanza, in their Dashboard Studio docs, suggests they below in "options"
Tried both, no annotations. Sorry I have no help but thought maybe you hadn't added seen the requirement for the options.