Dashboards & Visualizations

Cannot Get splitSeries to work in a Dashboard

gjeavons
Explorer

Hi,

I'm having trouble getting splitSeries to work in a Dashboard. I'd thought it was a problem with my saved search and advanced XML but having tried many approaches I'm not making headway. As a test, I created the simple version below but even with this the graph is still depicted as a single view rather than the split view I believe I'm configuring. I've come to the point where I'm not sure if I have a problem with the Syntax below or if this an a genuine issue with the splitSeries function?

thanks

Gary

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Alert Graph</label>
  <row>
    <chart>
      <searchString>index=geneos source="/var/log/geneos.log" | head 10000 | rex "(?i)^(?:[^ ]* ){4}(?P&lt;Status&gt;[^:]+)" | timechart count(Status) by Status</searchString>
      <title>Alerts over past hour</title>
       <earliestTime>-1h</earliestTime>
       <latestTime>now</latestTime>
        <option name="charting.chart">area</option>
        <option name="charting.legend.placement">Right</option>
        <option name="charting.layout.splitSeries">True</option>
        <option name="charting.primaryAxisTitle.text">Time</option>
        <option name="charting.secondaryAxisTitle.text">Count</option>
    </chart>
  </row>
</dashboard>
Tags (2)

gjeavons
Explorer

This was something I was trying to do a few months ago. In the end I had to take a different approach but would have really loved to get this working. I'm with you, I think its a bug, but unfortunately none have the Splunk Enginners have picked this one up yet. Hopefully they'll take a look at some point.

0 Karma

alexiri
Communicator

I have this same problem. Perhaps it's a bug? I'm running 4.2.4 (110225).

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...