Dashboards & Visualizations

Passing token to chart overlay


I've searched and searched on this and it's time to just ask the question.

I want to create a simple transaction count bar overlayed with the average duration line.  I can do this when hard setting the transaction name. 




However, when I try to generate an overlay using a dropdown of transaction names there is no overlay.  I feel like I'm just not passing a correctly formatted token to charting.chart.overlayFields option.



I've tried,

  • <option name="charting.chart.overlayFields">"avg(duration):" $ID$</option>
  • <option name="charting.chart.overlayFields">$ID$</option>
  • <option name="charting.chart.overlayFields">avg(duration): $ID$</option>
  • and probably dozens more as I'm throwing darts.

Any ideas here?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...