Dashboards & Visualizations

Is it possible to create a line chart using table columns and also see in tooltip?


I have a table with four columns - time, duration, clientip, query.

Duration is a numeric field and I can plot a line chart using first two columns, however I also want to see the corresponding last two columns in the tooltip, is this possible?

Labels (1)
0 Karma

Esteemed Legend


let me understand: you have a lookup containing many rows with one column, called e.g. source, with one value and another column with many values divided e.g. by comma that are destinations and you want to match (whitelist) each source and each destination in your main search, is this correct?

if this is your need and the field names are the same in main search and lookup (src, dest), you could use something like this:

<your_search> [ | inputlookup your_lookup.csv | eval dest=split(dest,",") | fields src dest ] | ...

for more infos about multivalue treatment, see at https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/MultivalueEvalFunctions



0 Karma



You understood it incorrectly, there is no source or dest columns

My search query yields a table with four columns which I am trying to plot as described above. I just want all of the columns to appear in the tooltip when users hoover over the line chart points.

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...