Dashboards & Visualizations

Multiline annotation_label

dajomas
Path Finder

I would like to put a text in the annotation_label, in a line chart, that has multiple lines.

Adding <BR> (using "& lt ;" and "& gt ;" (without spaces) ) or \n puts that text literally in the label and & #13;& #10; or & #10; (without spaces after &) just puts in a space

For instance:

| eval Value = "Value"
| eval annotation_label = Value . "< BR>" . Value . "\n" . Value

Results in the following tekst in the label (The space before BR is just to ensure the characters are shown correctly in this request. I don't have it in the real search)

Value< BR>Value\nValue

And I would like to see the following in the annotation label:

Value
Value
Value

Any help would be very much appreciated.

0 Karma

drebai
Explorer
| eval Value = "Value" 
| eval annotation_lab = Value . "," . Value . "," . Value 
| eval annotation_lab = split(annotation_lab,",")

This should give you the result you want

0 Karma

dajomas
Path Finder

I downvoted this post because yes, it splits a string into a multiline field but this does not give me the required result in the annotation_label. if i set annotation_label to a multiline value, there is simply no annotation_label in the chart. there is only an annotation line at the _time value

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...