Dashboards & Visualizations

Column Chart

pkeller
Contributor

My search produces output containing 5 license pool names, their configured pool size, and the volume that was indexed at the time of the rollover.

My search:
eventtype=evt-rollover-summary earliest=-1d latest=@d
| stats latest(poolsz) as "PoolSize" sum(b) as "PoolUsage" by pool
| rename pool AS "Pool Name"
| eval "Pool Size (Gb)" = round(PoolSize/1024/1024,0)
| eval "Pool Usage (Gb)" = round(PoolUsage/1024/1024,0)
| fields - PoolSize, PoolUsage

I'd like the column chart to just produce a 'dot' above the "Pool Usage (Gb)" column containing the "Pool Size (Gb)" field, but all I can seem to produce is a solid line for the overlay with nothing marking the line where the Pool Size Value is met.
Not sure what I need to choose in the Overlay section to highlight the associated Pool Size value above the Pool Usage for a given Pool.

0 Karma
1 Solution

somesoni2
Revered Legend

After you';ve selected the chart overlay, add following to line to your dashboard xml of the chart.

<option name="charting.chart.showMarkers">true</option>

Like this:

....
<chart>
    <search>
<query>eventtype=evt-rollover-summary earliest=-1d latest=@d 
 | stats latest(poolsz) as "PoolSize" sum(b) as "PoolUsage" by pool
 | rename pool AS "Pool Name"
 | eval "Pool Size (Gb)" = round(PoolSize/1024/1024,0)
 | eval "Pool Usage (Gb)" = round(PoolUsage/1024/1024,0) 
 | fields - PoolSize, PoolUsage
</query>
....
..
</search>
.....
        <option name="charting.chart.showMarkers">true</option>
......

View solution in original post

0 Karma

somesoni2
Revered Legend

After you';ve selected the chart overlay, add following to line to your dashboard xml of the chart.

<option name="charting.chart.showMarkers">true</option>

Like this:

....
<chart>
    <search>
<query>eventtype=evt-rollover-summary earliest=-1d latest=@d 
 | stats latest(poolsz) as "PoolSize" sum(b) as "PoolUsage" by pool
 | rename pool AS "Pool Name"
 | eval "Pool Size (Gb)" = round(PoolSize/1024/1024,0)
 | eval "Pool Usage (Gb)" = round(PoolUsage/1024/1024,0) 
 | fields - PoolSize, PoolUsage
</query>
....
..
</search>
.....
        <option name="charting.chart.showMarkers">true</option>
......
0 Karma

pkeller
Contributor

Thank you. Works perfectly.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...