Dashboards & Visualizations

Howto Add Annotations to a Graph?

muebel
SplunkTrust
SplunkTrust

I have a line graph that charts the consumed disk capacity for many hosts. It is very nice for giving a rough idea of the trends, and if I hover over the line at a specific point in time, I can get the capacity value at that time.

How would I be able to make a permanent marker or annotation at obvious points of interest? For instance, a 4% or %5 jump in consumed disk?

1 Solution

Paolo_Prigione
Builder

Hi muebel, I fear right now it is not possible: the "annotation" charts have not yet been implemented and on the module reference I can see no config for sticking permanent labels.

Moreover "obvious" points of interests should be something you have to help splunk figure out. A workaround could be to timechart something like the following, which might help you spot out potential issues:

| bucket _time span=1h | stats count(_raw) as c by _time,host | delta c as delta p=1 | eval perc_variation = round((delta * 100 / (c - delta)),1) | eval abs_variation=abs(perc_variation) | where abs_variation > 5 | fields host, c, perc_variation

View solution in original post

Paolo_Prigione
Builder

Hi muebel, I fear right now it is not possible: the "annotation" charts have not yet been implemented and on the module reference I can see no config for sticking permanent labels.

Moreover "obvious" points of interests should be something you have to help splunk figure out. A workaround could be to timechart something like the following, which might help you spot out potential issues:

| bucket _time span=1h | stats count(_raw) as c by _time,host | delta c as delta p=1 | eval perc_variation = round((delta * 100 / (c - delta)),1) | eval abs_variation=abs(perc_variation) | where abs_variation > 5 | fields host, c, perc_variation
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...