How to change the marker shape in a line chart

[Dev999]

In a line chart, I can add markers to the line. In a multi-line chart, I would like to have different markers for each line.

I am at Splunk 6.5.1. From an old document Splunk 6.2.3 document it seems possible at that version and I guess Splunk would not take the feature out in newer versions, though it's possible:

"You use shape properties to define shape objects for shape palettes, which are designed primarily to enable the assignation of specific shapes to chart markers. For example, you could arrange for each series in a line chart to have markers of different shapes. To do this you would define a list shape palette that sets up a specific shape object for each series, and then assign that to the markerShapePalette property."

Has anyone made this work in 6.5?

Thanks!

Here is a sample code for a single line example:

<dashboard>
  <label>test_chart_shape</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_audit earliest=-2h@h  (action=quota OR aciton=search OR action=accelerate_search) | stats count by action</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.showMarkers">true</option>
        <option name="charting.chart.markerSize">5</option>
      </chart>
    </panel>
  </row>
</dashboard>

[niketn · Accepted solution]

@Dev99, what you are referring from version 6.2 is Advanced XML Development, which has been deprecated way back.

In Splunk Enterprise 7.0 there is a new chart enhancement which allows us to select different styles for different series through new Simple XML Chart Configuration called charting.fieldDashStyles

Foe example if you have two series field1 and field2 you can apply the following:

<option name="charting.fieldDashStyles">{"field1":"solid", "field2":"shortDash"}</option>

You can check out the same in Splunk 7.0 Overview App from Splunkbase
or read the documentation for Simple XML Chart Configuration and various series style options: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pro...

[Dev999]

Thanks for clarification. I found your other post with the workaround for dash style and works like a charm: change dash style. It's not for marker but it's better than nothing. I bet with that kind of knowledge you can change the marker style as well?

[niketn]

@Dev999, do up vote the answers https://answers.splunk.com/answers/568412/using-chartinglinedashstyle-to-edit-only-one-line.html if that helped you. As stated, since the CSS override is built in to Splunk Enterprise 7.0, I would expect Splunkers would not need the manual CSS Override to apply different Line Dash Styles for different series in near future unless they are on any of previous versions.

Coming back to Markers in HighCharts, I will try to find some time to figure out if there is a way with CSS and JS Extension for changing the Chart Markers. Following are the two challenges:

1) While Highcharts supports several Marker Types for each individual series and even Custom images using URL, Splunk applies only one Marker to all series. Which means even if we changed the Marker type from circle to triangle using svg path, it will apply to all series not individual/specific.
http://jsfiddle.net/gh/get/library/pure/highcharts/highcharts/tree/master/samples/highcharts/plotopt...

2) SVG to build/plot Markers is generated dynamically. The SVG path values, which draw the Markers at required positions on the chart have both location and shape details. Which we can change the shape through CSS Override, it will be difficult (not sure even if possible or not). Even if it worked it would be crooked way of drawing chart first with Circle and then overriding with Triangle.

Considering above two pot-holes, if you have active Splunk Entitlement, you can put in an enhancement request. I know there was a previous issue open for several years around the same issue with one static showMarker being available for all series, because of which series being plotted could not be distinguished easily. However the question got archived due to age.

Second option would be time consuming but you can use Splunk's Custom Visualization API to create your own Highcharts Line Chart with options for showMarkers.

[Dev999]

It does not worth the efforts if it changes all. The whole point is to mimic Excel plot with different markers. I guess most can live with different colors and dash styles.

Thanks!