Cannot Get splitSeries to work in a Dashboard

[gjeavons]

Hi,

I'm having trouble getting splitSeries to work in a Dashboard. I'd thought it was a problem with my saved search and advanced XML but having tried many approaches I'm not making headway. As a test, I created the simple version below but even with this the graph is still depicted as a single view rather than the split view I believe I'm configuring. I've come to the point where I'm not sure if I have a problem with the Syntax below or if this an a genuine issue with the splitSeries function?

thanks

Gary

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Alert Graph</label>
  <row>
    <chart>
      <searchString>index=geneos source="/var/log/geneos.log" | head 10000 | rex "(?i)^(?:[^ ]* ){4}(?P&lt;Status&gt;[^:]+)" | timechart count(Status) by Status</searchString>
      <title>Alerts over past hour</title>
       <earliestTime>-1h</earliestTime>
       <latestTime>now</latestTime>
        <option name="charting.chart">area</option>
        <option name="charting.legend.placement">Right</option>
        <option name="charting.layout.splitSeries">True</option>
        <option name="charting.primaryAxisTitle.text">Time</option>
        <option name="charting.secondaryAxisTitle.text">Count</option>
    </chart>
  </row>
</dashboard>

[gjeavons]

This was something I was trying to do a few months ago. In the end I had to take a different approach but would have really loved to get this working. I'm with you, I think its a bug, but unfortunately none have the Splunk Enginners have picked this one up yet. Hopefully they'll take a look at some point.

[alexiri]

I have this same problem. Perhaps it's a bug? I'm running 4.2.4 (110225).