Dashboards & Visualizations

Multi series column chart with overlay separate y-axis

nirmalya2006
Path Finder

Hi All

I am trying to create a multiseries column chart over time with two different y-axis - one on left and one on right.
My Basic query is as below :

| stats avg(eval(iBatchSize/1024)) as Avg, avg(iDocCount) as Count by _time

What I am trying to achieve is to create column chart as below
The blue columns to show average batch size and the red columns to show document count.
They will come in pairs for a span=1d.
Blue columns will have the y-axis on the left side of the chart and red columns on the right.
This is because the values cannot be brought on the same scale.

alt text

I want to know if this can at all be done.
If so, please guide me.

Thanks in advance

0 Karma

sundareshr
Legend
0 Karma

jkat54
SplunkTrust
SplunkTrust

Converted to answer because chart overlays will do exactly what the requester is asking for.

0 Karma

sundareshr
Legend

@nirmalaya2006 The overlay field in a chart can only be set as a line. You cannot set it as a column.

0 Karma

nirmalya2006
Path Finder

Thant is exactly where I am stuck.

Chart overlay cannot show double columns.
I need to implement a multi series chart but I am unable to do so.

Please help me to get this working.

0 Karma

sundareshr
Legend

I am not aware of a way this can be achieved. Besides, not sure if it is the best format - having two column next to each other with differing scale.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...