Dashboards & Visualizations

Multiline annotation_label

dajomas
Path Finder

I would like to put a text in the annotation_label, in a line chart, that has multiple lines.

Adding <BR> (using "& lt ;" and "& gt ;" (without spaces) ) or \n puts that text literally in the label and & #13;& #10; or & #10; (without spaces after &) just puts in a space

For instance:

| eval Value = "Value"
| eval annotation_label = Value . "< BR>" . Value . "\n" . Value

Results in the following tekst in the label (The space before BR is just to ensure the characters are shown correctly in this request. I don't have it in the real search)

Value< BR>Value\nValue

And I would like to see the following in the annotation label:

Value
Value
Value

Any help would be very much appreciated.

0 Karma

drebai
Explorer
| eval Value = "Value" 
| eval annotation_lab = Value . "," . Value . "," . Value 
| eval annotation_lab = split(annotation_lab,",")

This should give you the result you want

0 Karma

dajomas
Path Finder

I downvoted this post because yes, it splits a string into a multiline field but this does not give me the required result in the annotation_label. if i set annotation_label to a multiline value, there is simply no annotation_label in the chart. there is only an annotation line at the _time value

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...