Dashboards & Visualizations

Multiline annotation_label

dajomas
Path Finder

I would like to put a text in the annotation_label, in a line chart, that has multiple lines.

Adding <BR> (using "& lt ;" and "& gt ;" (without spaces) ) or \n puts that text literally in the label and & #13;& #10; or & #10; (without spaces after &) just puts in a space

For instance:

| eval Value = "Value"
| eval annotation_label = Value . "< BR>" . Value . "\n" . Value

Results in the following tekst in the label (The space before BR is just to ensure the characters are shown correctly in this request. I don't have it in the real search)

Value< BR>Value\nValue

And I would like to see the following in the annotation label:

Value
Value
Value

Any help would be very much appreciated.

0 Karma

drebai
Explorer
| eval Value = "Value" 
| eval annotation_lab = Value . "," . Value . "," . Value 
| eval annotation_lab = split(annotation_lab,",")

This should give you the result you want

0 Karma

dajomas
Path Finder

I downvoted this post because yes, it splits a string into a multiline field but this does not give me the required result in the annotation_label. if i set annotation_label to a multiline value, there is simply no annotation_label in the chart. there is only an annotation line at the _time value

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...