Dashboards & Visualizations

How can I overlay multiple fields in Dashboard Studio Column Chart?

_smp_
Builder

I have a saved report with three output fields that I want to add to a Column chart in Dashboard studio. Two of the three fields contain static values (license limit and optimal utilization threshold) that I want to add as overlays to the third utilized SVC field. I can't seem to get the JSON correct. This is as close as I have come. How can I add two fields as overlays in a Column chart? Image attached.

 

 

{

    "type": "splunk.column",
    "dataSources": {
        "primary": "ds_search_1"
    },
    "title": "SVC License Usage (today)",
    "options": {
        "yAxisAbbreviation": "off",
        "y2AxisAbbreviation": "off",
        "showRoundedY2AxisLabels": false,
        "legendTruncation": "ellipsisMiddle",
        "showY2MajorGridLines": true,
        "xAxisTitleVisibility": "hide",
        "yAxisTitleText": "SVC Usage",
        "overlayFields": ["optimal utilization threshold", "license limit"],
        "columnGrouping": "overlay"
    },
    "context": {},
    "showProgressBar": false,
    "showLastUpdated": false
}

 

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without 

"columnGrouping": "overlay"

 

0 Karma

_smp_
Builder
That was one of many things I've tried. Removing that property results in a timechart with a separate column for each field.
0 Karma

nickdekkersmt
Loves-to-Learn

did you found a solution?

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...