Dashboards & Visualizations

Line chart annotation is not working with non-time based x-axis in Dashboard Studio

yoongchean
Observer

I try to plot a line graph where the x-axis is an index  and y-axis is a random value. I also trying to add an annotation where the annotationX is an index. Below is the code for the visualization.

 

 

"visualizations": {
		"viz_kHEXe45c": {
			"type": "splunk.area",
			"dataSources": {
				"primary": "ds_Search_1",
				"annotation": "ds_annotation_markers"
			},
			"options": {
				"x": "> primary | seriesByIndex(0)",
				"annotationX": "> annotation | seriesByIndex(0)",
				"annotationLabel": "> annotation | seriesByIndex(1)",
				"annotationColor": "> annotation | seriesByIndex(2)",
				"nullValueDisplay": "zero"
			},
			"title": "Test Event Annotation",
			"showProgressBar": false,
			"showLastUpdated": false
		}
	},
	"dataSources": {
		"ds_Search_1": {
			"type": "ds.search",
			"options": {
				"query": "| makeresults count=15\n| streamstats count\n| eval index=count\n| eval value=random()%100\n| fields index value"
			},
			"name": "ds_Search_1"
		},
		"ds_annotation_markers": {
			"type": "ds.search",
			"options": {
				"query": "| makeresults count=3\n| streamstats count\n| eval index=count\n| eval score = random()%3 +1\n| eval status = case(score=1,\"server error detected\", score=2, \"unknown user access\", score=3, \"status cleared\")\n| eval color = case(score=1,\"#f44271\", score=2, \"#f4a941\", score=3, \"#41f49a\")\n| table index status color"
			},
			"name": "ds_annotation_markers"
		}
	},

 

 

 

Below is the line graph output shown based on the code above.

yoongchean_0-1715141398222.png

 

Could anyone please help how to add the annotation on the line graph when the x-axis is a non-time based number type?

 

Labels (2)
Tags (2)
0 Karma

KendallW
Contributor

Hi @yoongchean It might be because makeresults generates the _time field, which Splunk automatically puts on the x axis when no chart options are specified. Try simply removing the _time field with 

| fields - _time



0 Karma

yoongchean
Observer

Hi @KendallW , I have add the fields - _time at the last SPL command to remove the _time field. Unfortunately, it still doesn't show the annotation in the line graph.  

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...