Dashboards & Visualizations

Multiline annotation_label

dajomas
Path Finder

I would like to put a text in the annotation_label, in a line chart, that has multiple lines.

Adding <BR> (using "& lt ;" and "& gt ;" (without spaces) ) or \n puts that text literally in the label and & #13;& #10; or & #10; (without spaces after &) just puts in a space

For instance:

| eval Value = "Value"
| eval annotation_label = Value . "< BR>" . Value . "\n" . Value

Results in the following tekst in the label (The space before BR is just to ensure the characters are shown correctly in this request. I don't have it in the real search)

Value< BR>Value\nValue

And I would like to see the following in the annotation label:

Value
Value
Value

Any help would be very much appreciated.

0 Karma

drebai
Explorer
| eval Value = "Value" 
| eval annotation_lab = Value . "," . Value . "," . Value 
| eval annotation_lab = split(annotation_lab,",")

This should give you the result you want

0 Karma

dajomas
Path Finder

I downvoted this post because yes, it splits a string into a multiline field but this does not give me the required result in the annotation_label. if i set annotation_label to a multiline value, there is simply no annotation_label in the chart. there is only an annotation line at the _time value

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...