Dashboards & Visualizations

Howto Add Annotations to a Graph?

muebel
SplunkTrust
SplunkTrust

I have a line graph that charts the consumed disk capacity for many hosts. It is very nice for giving a rough idea of the trends, and if I hover over the line at a specific point in time, I can get the capacity value at that time.

How would I be able to make a permanent marker or annotation at obvious points of interest? For instance, a 4% or %5 jump in consumed disk?

1 Solution

Paolo_Prigione
Builder

Hi muebel, I fear right now it is not possible: the "annotation" charts have not yet been implemented and on the module reference I can see no config for sticking permanent labels.

Moreover "obvious" points of interests should be something you have to help splunk figure out. A workaround could be to timechart something like the following, which might help you spot out potential issues:

| bucket _time span=1h | stats count(_raw) as c by _time,host | delta c as delta p=1 | eval perc_variation = round((delta * 100 / (c - delta)),1) | eval abs_variation=abs(perc_variation) | where abs_variation > 5 | fields host, c, perc_variation

View solution in original post

Paolo_Prigione
Builder

Hi muebel, I fear right now it is not possible: the "annotation" charts have not yet been implemented and on the module reference I can see no config for sticking permanent labels.

Moreover "obvious" points of interests should be something you have to help splunk figure out. A workaround could be to timechart something like the following, which might help you spot out potential issues:

| bucket _time span=1h | stats count(_raw) as c by _time,host | delta c as delta p=1 | eval perc_variation = round((delta * 100 / (c - delta)),1) | eval abs_variation=abs(perc_variation) | where abs_variation > 5 | fields host, c, perc_variation
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...