Column Chart

[pkeller]

My search produces output containing 5 license pool names, their configured pool size, and the volume that was indexed at the time of the rollover.

My search:
eventtype=evt-rollover-summary earliest=-1d latest=@d
| stats latest(poolsz) as "PoolSize" sum(b) as "PoolUsage" by pool
| rename pool AS "Pool Name"
| eval "Pool Size (Gb)" = round(PoolSize/1024/1024,0)
| eval "Pool Usage (Gb)" = round(PoolUsage/1024/1024,0)
| fields - PoolSize, PoolUsage

I'd like the column chart to just produce a 'dot' above the "Pool Usage (Gb)" column containing the "Pool Size (Gb)" field, but all I can seem to produce is a solid line for the overlay with nothing marking the line where the Pool Size Value is met.
Not sure what I need to choose in the Overlay section to highlight the associated Pool Size value above the Pool Usage for a given Pool.

[somesoni2 · Accepted solution]

After you';ve selected the chart overlay, add following to line to your dashboard xml of the chart.

<option name="charting.chart.showMarkers">true</option>

Like this:

....
<chart>
    <search>
<query>eventtype=evt-rollover-summary earliest=-1d latest=@d 
 | stats latest(poolsz) as "PoolSize" sum(b) as "PoolUsage" by pool
 | rename pool AS "Pool Name"
 | eval "Pool Size (Gb)" = round(PoolSize/1024/1024,0)
 | eval "Pool Usage (Gb)" = round(PoolUsage/1024/1024,0) 
 | fields - PoolSize, PoolUsage
</query>
....
..
</search>
.....
        <option name="charting.chart.showMarkers">true</option>
......

[pkeller]

Thank you. Works perfectly.